Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
@slash-bang: You'll be uploading a proper .jpeg file, just the comment inside it will be PHP code. The shell will run if the server allows JPEG files to be executed, so it will depend.
@Rook: The file that is gonna be uploaded is a valid jpeg (with a .jpeg/.jpg extension), so the whitelisting should be bypassed. The PHP code needs to be placed inside the comment.
@user31079: Not exactly. An auditor takes one or more standards and checks if the solution is compliant to the requirements (depending on the standard, this may or may not include fixing vulnerabilities).
