Remote Code Execution (RCE) is one of the most critical vulnerabilities. It allows an attacker to execute system commands directly on web hosting servers.
1. Insecure File Upload Vectors
If a web form accepts avatar images but does not validate file extensions, an attacker can upload a web shell payload (e.g. `shell.php`) instead of an image. If the upload folder is inside the web root and permits execution, accessing `/uploads/shell.php` executes the script.
2. Mitigation Strategies
- Always rename uploaded files using unique hashes (e.g. UUID).
- Restrict execution permissions on upload directories using `.htaccess` or server rules:
<Files *.php> deny from all </Files>