[Skidy]

So, on this website I can upload an image, change the file type to a PHP but if I change the images data at all I get this:

Code

HTTP/1.1 500 Internal Server Error
Date: Tue, 04 Apr 2017 16:44:58 GMT
Content-Type: application/json
Content-Length: 0
Connection: close
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
CF-RAY: 34a5bc3a905934e8-LHR

Is this a cloudflare issue, WAP or just because it recognises it as a non-valid image file.

[andmuchmore]

I would try and get the server's real IP and patch your config file to bypass cloudflare.. Alot of peoples cloudflare configs are busted and getting the server's really IP is trivial

[Skidy]

I would try and get the server's real IP and patch your config file to bypass cloudflare.. Alot of peoples cloudflare configs are busted and getting the server's really IP is trivial

I am pentesting a website. This is the last step in my vulnerability to get an RCE.

[striker111]

I am pentesting a website. This is the last step in my vulnerability to get an RCE.

This depends on whether the website has CF's WAF protection or not.
Secondly, either WAF is Enabled or not.

If the security level for website is set to High or UnderAttackMode, You cannot bypass this.