[Electron]

Hello guys!
I'm trying to upload a shell via Firefox's Addon Tamper Data. I got a shell that I save for example as c99.php.jpg. I'm choosing that file in the upload form which code is down. Then Tools > Tamper Data > Start Temper Data > Submitting the form > Clicking on the "Tamper" button and editing c99.php.jpg to c99.php. Then the upload form gives me an error that I can't upload the shell due to the restriction in the extensions. I tried that with a few forms, same for all. I know that it might not work with all of the forms but can you give me any that is vulnerable or what am I doing wrong. Thanks in advance!

upload.php form: http://pastebin.com/Mu5kzbEg

[.kr.]

it's a server side extension check; not javascript. your tamper and edit filename is useless

[Charger]

it's a server side extension check; not javascript. your tamper and edit filename is useless

This.

You can't bypass it if it's checked server side.

[SIM-3471583]

You should try to look for RFI's in order to inject a shell

[Electron]

Thanks guys! I'm trying different attacks to check how it goes, thanks for the advice as well

[vaiperboy]

find other ways to upload the shell, get admin info or smth

[redlightrouter]

Without testing and purely looking at the code I think it's still vulnerable. Try c99.php;.jpg and change the MIME to image/jpg

Code

if($file_size > 2097152){
         $errors[]='File size must be excately 2 MB';
      }

Dunno if this is an unrestricted upload challenge or not, but the file could be anything below 2097152 and does t have to be exactly 2mb.

Edit:

Analyzed the code again, and I changed my mind. I do not think it's possible to upload php.

[spasta]

do you need shells hit me up with ur skype