Lab 307 — CrewHub — File Upload RCE via Polyglot JPG/PHP

hackadvisor

Task: PHP project management app with avatar upload validated by GD library, but preserving original file extension and not stripping EXIF data. Solution: craft a polyglot JPG/PHP with a webshell in EXIF ImageDescription, upload with .php extension to bypass GD validation, then execute commands to read /root/flag.txt.