File uploads · Question 11 of 12
A form allows uploading "applications" and stores them in fileadmin/. An attacker uploads application.php. Which measures prevent the damage?
2 answers are correct. Hard
Show answer
Answer
- B Store the file with a neutral name in a non-executable folder
- D Accept only allowed extensions via an allowlist and check the content
Explanation
An allowlist does not let .php through in the first place; a non-executable target turns a hit into no web shell. The file size alone prevents nothing.