Download Netsparker
Pricing
Blog
Contact
Netsparker

Code Execution via File Upload and Remedy Explained

Netsparker detected a code execution via file upload. Netsparker successfully uploaded a file and when requesting the uploaded file, code is executed in the context of the web server.

Impact

The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.

Remedy

  • Never accept a filename and its extension directly without having a white-list filter.
  • Uploaded directory should not have any "execute" permission.

External References


Go back to the Complete list of Vulnerability Checks.