An avatar uploader screens for the obvious extension only. Slip through a file the server still runs as code.
Avatar / file uploader
Upload a profile picture. Uploaded files are stored under /uploads/ and can be opened
directly in the browser. Get the server to execute your file as code.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
