Lab 162 — VaultDrop — File Upload Race Condition (TOCTOU)

hackadvisor

Task: PHP file sharing platform with avatar upload and asynchronous security scanning — TOCTOU race condition in file validation. Solution: upload PHP webshell with spoofed Content-Type, race the async scanner by immediately requesting the uploaded file URL before deletion, achieve RCE and read /root/flag.txt.