webPromedium
Lab 254 — PageForge — ZIP Upload File Type Bypass to RCE
hackadvisor
Task: PHP CMS with theme import feature that extracts ZIP archives to a web-accessible directory without filtering file types inside the archive. Solution: include a PHP webshell (shell.php) inside a valid theme ZIP alongside theme.json, upload via /themes/import, then access the extracted webshell at /uploads/themes/<name>/shell.php for RCE.
$ ls tags/ techniques/
decoy_flag_identificationzip_file_type_bypassphp_webshell_in_zipunrestricted_file_extraction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass— hackadvisor
- [web][Pro]PageForge— hackadvisor
- [web][Pro]Lab 94 — MediaForge — ImageMagick Command Injection via File Upload (ImageTragick)— hackadvisor
- [web][Pro]Lab 25 — DocuForge — RCE via Dompdf Font Cache Exploitation— hackadvisor
- [web][Pro]ContentForge— hackadvisor