bug-bounty458
google364
microsoft314
facebook272
xss250
apple179
malware176
rce165
exploit141
cve111
account-takeover104
bragging-post101
phishing84
privilege-escalation81
csrf81
supply-chain68
stored-xss65
authentication-bypass63
dos63
browser62
reflected-xss57
react54
cloudflare51
reverse-engineering49
cross-site-scripting48
input-validation48
aws48
docker47
node47
access-control47
smart-contract45
web343
ethereum43
sql-injection43
web-security42
ssrf42
defi42
web-application41
oauth37
writeup37
race-condition36
burp-suite35
vulnerability-disclosure34
info-disclosure34
idor34
html-injection33
cloud33
auth-bypass33
lfi32
smart-contract-vulnerability32
0
8/10
vulnerability
A remote image upload feature allowing RCE through injecting PHP payloads into GIF images with Netscape Looping Application Extensions, which survive PHP-GD image recreation due to preserved null byte blocks. The attack bypasses file extension validation by renaming uploaded images to .php and exploiting image processing that fails to sanitize injected code in GIF metadata.
remote-file-upload
rce
php-gd
image-injection
gif-exploitation
jpeg-injection
file-upload-bypass
payload-injection
php-execution
netscape-looping-extension
null-byte-injection
PHP-GD
dlegs/php-jpeg-injector
fakhrizulkifli/Defeating-PHP-GD-imagecreatefromjpeg
ABOUL3LA
asdqwe3
Imagemagick