Unvalidated file upload is a very critical vulnerability for Web applications, since if
present, it allows an attacker in a very short time to upload, for example, a webshell on the
server and take possession of it.
The remedies in the management of upload
files, are reported in the best practices of the slide, among the most important indications:
check the type of incoming file before accepting it.
Remember that checking the extension is not enough.
But among the metadata of the file, check the so-called magic number consisting of the first four
bytes of the header of the file, that identifies its type.
Thank you for your kind attention.