A form that lets visitors upload files is one of the most commonly exploited features on any website. If an attacker can upload a script and then execute it, they control the site.
RULES FOR ANY UPLOAD FEATURE
Validate the file type on the server, not only in the browser. Browser-side checks are trivially bypassed. Use an allow list of permitted extensions, not a block list of forbidden ones. Never accept .php, .phtml, .phar, .cgi, .pl, .sh or .htaccess uploads. Check the actual file contents, not just the extension. A PHP script renamed to .jpg is a classic technique. Rename uploaded files to a random name rather than keeping the user's filename. Set a maximum file size. Store uploads outside public_html where the application design allows it.
BLOCKING EXECUTION IN THE UPLOADS FOLDER
Add a .htaccess inside your uploads directory containing:
<FilesMatch "\.(php|phtml|phar|cgi|pl)$">
Require all denied
</FilesMatch>This means that even if a malicious file gets in, it cannot be run.
CHECKING AN EXISTING SITE
Look through your uploads folder for PHP files. Nothing legitimate puts PHP there. Anything you find should be treated as a compromise and investigated.
