File upload vulnerability upload-libs pass2
First View source
found to be the back-end PHP filter, allowing only type image / jpeg image / png image / gif file upload, the word Trojan suffix to jpg
upload pictures and capture
Send to Repeater
modify the file suffix .php
Go
find the incoming path, only this time a little faster browser test
successful
