Understanding and Preventing Malicious File Upload Vulnerabilities

During a recent security test the most frequent vulnerabilities, aside from SQL injection, were malicious file uploads; although fewer in number, their impact can far exceed that of SQL injection, making careful handling essential in development.

File‑upload vulnerabilities allow attackers to place executable files (e.g., web shells, trojans, malicious scripts, or even crafted images) on a server and execute them, potentially gaining full control, running system commands, or stealing database credentials.

Example 1 sets up a simple project with an upload1.php script that accepts any file without validation, an uploadtest directory, an uploads folder for stored files, a malicious hacker.php payload, and a front‑end page upload1.html . The vulnerable code essentially moves the uploaded file to uploads/ without checking type or extension.

The demonstration shows that after uploading hacker.php , the file becomes accessible via http://localhost/regist/upload/hacker.php . Inside the payload the core line is system($_GET['cmd']); , which executes any Linux command supplied via the cmd GET parameter, giving the attacker command‑execution capability.

Example 2 modifies the original script to add a file‑type check (e.g., if($_FILES['userfile']['type'] != "image/gif") ). While this blocks non‑image uploads, an attacker can simply alter the request’s Content‑Type header (e.g., to image/jpeg ) to bypass the check and successfully upload the malicious script.

Prevention methods include:

Prefer whitelist over blacklist for allowed file extensions (e.g., .jpg, .png, .gif, .bmp for images; .doc, .pdf, .txt for documents; .zip, .rar for archives).

Enforce server‑side validation: verify MIME type, scan for embedded code, and never rely solely on client‑side JavaScript checks.

Store uploaded files outside the web root or on a dedicated remote server, and serve them through a controlled proxy.

By applying these measures, developers can significantly reduce the risk of malicious file‑upload attacks.