CEH Web Application and Injection Attacks Practice Question
A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File upload vulnerability
The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Directory traversal
Why it's wrong here
Directory traversal vulnerabilities allow an attacker to read or write files to arbitrary locations on the server's file system by manipulating file paths, typically using sequences like "../". However, this attack vector does not inherently provide a mechanism for uploading a new, arbitrary malicious file from the client to the server for execution. The scenario explicitly describes an upload leading to server-side code execution, which is distinct from path manipulation for existing files.
- ✗
Command injection
Why it's wrong here
Command injection occurs when an application executes operating system commands constructed with unsanitized user input, allowing an attacker to inject and execute arbitrary system commands directly. While highly severe, this vulnerability is distinct from the scenario where a malicious file is uploaded to the server and subsequently executed by the web server itself. The attack vector here is the file upload mechanism, not the manipulation of command-line arguments passed to a shell.
- ✓
File upload vulnerability
Why this is correct
A file upload vulnerability arises when a web application permits users to upload files without sufficient validation of their type, content, or proper handling of their storage and execution. The ability for an attacker to upload a malicious PHP file, which is then executed by the web server, perfectly exemplifies this vulnerability. This allows for remote code execution (RCE) on the server, directly matching the described attack where a 'profile picture' turns out to be an executable script.
- ✗
Stored XSS
Why it's wrong here
Stored Cross-Site Scripting (XSS) involves injecting persistent client-side scripts, typically JavaScript, into a web application's data store, which are then served to other users' browsers. When a victim's browser renders the compromised content, the malicious script executes within their browser context, allowing for session hijacking, defacement, or redirection. This attack targets the client-side and does not involve uploading server-side executable files or achieving remote code execution on the web server itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.