PHP File Upload

Alert ID: php_upload MITRE ATT&CK: T1505.003 – Server Software Component: Web Shell

---

Severity / Criticality

Critical

Any PHP file detected inside the uploads directory is considered a serious threat.

---

Why is it considered malicious?

• Web shells: allow remote command execution on the server.
• Backdoors: give the attacker persistent access.
• Cryptominers: use server resources without authorization.
• Spam mailers: turn the site into a bulk spam platform.
• Data exfiltration: theft of sensitive information.

Caution

The uploads directory must not contain executable code under any circumstances.

---

When does the alert trigger?

• Immediate detection of suspicious extensions: .php, .php3, .php4, .php5, .phtml, .phar.
• Other monitored extensions:
  • Scripts: .asp, .aspx, .jsp, .cgi, .pl, .py, .rb.
  • Executables: .exe, .dll, .bat, .sh, .ps1.
• Content analysis: PHP indicators such as <?php, <?=.
• Deduplication window: 30 seconds.

---

Technical Indicators (IOCs)

Type	Pattern	Description
file_pattern	eval($_POST['cmd']);	Remote code execution
file_pattern	system($_GET['command']);	System command execution
file_pattern	base64_decode(	Obfuscated code
file_pattern	file_get_contents('php://input')	Direct read from PHP input
file_pattern	c99.php, r57.php, wso.php	Known web shells

---

Common false positives

• Poorly designed legitimate plugins that allow PHP uploads.
• Developers uploading test code, which is bad practice.
• Migration or backup tools that do not use temporary directories.

Attention

Even “false positives” represent serious security weaknesses that must be fixed.

---

Investigation steps

1. Do not execute the file. Inspect it with:

   strings /path/to/file.php | grep -E 'eval|exec|system|base64'

2. Calculate the file’s MD5 and SHA256 hashes.

3. Verify origin through timestamp and access logs (user/IP).

4. Search for other shells:

   find wp-content/uploads -name "*.php" -type f

5. Review logs for requests targeting the suspicious file.

---

Recommended mitigations

Automatic response in Vulnity

When the plugin detects a PHP file inside wp-content/uploads, Vulnity does more than create an alert:

• It records file evidence, including path, filename, and hashes when available.
• It attempts to install or reinforce a rule that blocks PHP execution inside uploads.
• It verifies whether the server is still executing PHP in that directory.
• If the block cannot be applied or is not effective, it moves the file to wp-content/uploads/vulnity-quarantine/ with a .quarantine suffix and protects that directory with deny rules.
• From the alert panel, when quarantine context is available, you can restore the file or delete it permanently from WordPress.

Only restore a file after manually verifying that it is not malicious. Deletion is irreversible from Vulnity.

Immediate

Danger

• Isolate the file. If you need evidence, review hashes and content before deletion.
• If Vulnity quarantined it, keep it there until the review is complete.
• Permanently delete it from the alert only after confirming it is malicious.
• Block access through .htaccess.
• Scan the full site with antimalware tools.
• Change all passwords: WordPress, hosting, FTP, and database.

Preventive

Tip

Add inside wp-content/uploads/.htaccess:

<FilesMatch "\.(?:php|phtml)$">
Deny from all
</FilesMatch>

• Restrict upload policies to images and documents only.
• Validate files server-side before storing them.
• Implement mod_security with web-shell detection rules.
• Use safe permissions: 755 for upload folders, 644 for files.

---

References

• MITRE ATT&CK T1505.003 – Web Shell
• OWASP Unrestricted File Upload
• Web Shells Database