PHP upload script might be vulnerable

Question

I have written a basic PHP upload script a few years ago and recently I discovered some phishing html pages in the website's root.

This website is located in /www/sitename, while I upload the files to /gstorage/sitename, which can't be accessed from the web.

I have found a lot of html files in /www/sitename and it seems like they somehow came through the upload.php file, as I've found a POST from a specific ip to this file in the logs before the files appeared and then that IP started sending post to those files.

Here's the code:

include('inc.php');
$disallowed = array('php', 'php5');

if(isset($_FILES['upl']) && $_FILES['upl']['error'] == 0){

    $extension = pathinfo($_FILES['upl']['name'], PATHINFO_EXTENSION);

    if(in_array(strtolower($extension), $disallowed)){
        echo '{"status":"error", "message":"no PHP"}';
        exit;
    }
    $url = findNewURL();
    $size = formatSizeUnits($_FILES['upl']['size']);
    if(move_uploaded_file($_FILES['upl']['tmp_name'], '/gstorage/edited/'.$url)){
        try {
            $stmt = $db->prepare("INSERT INTO files(url, filename, size, type) VALUES(:url,:filename,:size, :type)");
            $stmt->execute(array(":url" => $url, ":filename" => $_FILES['upl']['name'], ":size" => $size, ":type" => $_FILES['upl']['type']));
        } catch(PDOException $ex) {
            echo 'Error!';
            echo $ex->getMessage();
        }

        echo '{"status":"success", "link": "http://edited.org/'.$url.'"}';
        exit;
    }
}
echo '{"status":"error"}';
exit;

Where could the vulnerability be?

Answer 1

Your extension check is pretty much useless, as I can still upload a variety of files with extensions that can gain me code execution, such as php4 or .htaccess. If possible, use a whitelist approach instead.

But in your case, it doesn't really matter, as you are not using the extension anyways, the filename is just a random 5 character string without extension.

You should also always use prepared statements. Yes, $file is currently controlled by you, but who knows, that may change in the future.

Apart from this, I don't see any vulnerabilities in your script. My guess is that the vulnerability is somewhere else (seeing the logged request that you suspect would still be interesting).