Updates php/challenge-65.md

Auto commit by GitBook Editor
CHYbeta · Dec 28, 2017 · ea97b6d · ea97b6d
1 parent b57a484
commit ea97b6d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/php/challenge-65.md b/php/challenge-65.md
@@ -24,6 +24,7 @@ $challenge = new Challenge($_FILES['solution']);
 ```
 
 # Solution 
+The challenge contains an arbitrary file upload vulnerability in line 13. The operation in_array() is used in line 12 to check if the file name is a number. However, it is type-unsafe because the third parameter is not set to 'true'. Hence, PHP will try to type-cast the file name to an integer value when comparing it to the array $whitelist (line 8). As a result it is possible to bypass the whitelist by prepending a value in the range of 1 and 24 to the file name, for example "5backdoor.php". The uploaded PHP file then leads to code execution on the web server.
 
 # Refference 
 + php-security-calendar-2017 Day 1 - Wish List