Lab 39 — PixelVault — RCE via ImageMagick Filename Command Injection

hackadvisor

Task: Image hosting platform with custom_filename field passed to ImageMagick shell command inside double quotes, protected by escapeshellcmd(). Solution: Backtick command injection in custom_filename bypasses escapeshellcmd() inside double-quoted context, executing cp to copy /root/flag.txt to web-accessible uploads directory.