Simple Analysis of an upload function Upload Vulnerability

 

Function fnUploadImg (ByVal upFile As HttpPostedFile, ByVal uploadPath As String) As String Dim result As String = "" Dim intImgSize As Int32 intImgSize = upFile. contentLength If intImgSize <> 0 Then If intImgSize> 500000 Then result = "the image is too large" Return result Exit Function End If Dim strImgType As String = upFile. contentType 'only accepts images in .jpg format: Dim filesplit () As String = Split (strImgType, "/") strImgType = filesplit (filesplit. length-1) If strImgType = "jpg" Or strImgType = "jpeg" Then Else result = "incorrect image format" Return result Exit Function End If filesplit = Split (upFile. fileName, "\") Dim filename As String = filesplit (filesplit. length-1) upFile. saveAs (Server. mapPath ("upload \ location \" & uploadPath) & "\" & filename) dim imgpath As String = "upload/location/" & uploadPath & "/" & filename result = imgpath Return result End If End Function

Breakthrough method: upload arbitrary files, capture packets, and modify Content-Type to: image/jpeg