> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/wreath-try-hack-me/pivoting/10.200.101.100/code-analysis.md).

# Code Analysis

We can find an vulnerability in a php file

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FH9H65O46IhLj0xldndqW%2Fimage.png?alt=media&amp;token=f7f8c062-7218-4a01-ac0a-1cbc65a9f4ff" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FtGlV3MTfCOERGD5dWVsV%2Fimage.png?alt=media&amp;token=47088828-3dbc-4a04-abf6-e9c27bdd1e7d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FoIgQRMjV06KiANpWQrbc%2Fimage.png?alt=media&amp;token=5ba6a8ff-8b43-48a8-9bed-af3210dd4b85" alt=""><figcaption></figcaption></figure>

Possible Vulnerable File upload exploit. Improper handling with the splitting of the image name