What is arbitrary file download? As the name suggests, if the web application doesn’t check the file name required by the user, any malicious user can exploit this vulnerability to download sensitive files from the server. … This method takes user’s input and assigns the value to the ‘filename’ parameter.

What is arbitrary file deletion?

In PHP an arbitrary file deletion occurs when the unlink() function is called and user input can affect parts of or the whole parameter $filename, which is the path of the file to delete, without undergoing proper sanitization.

What is unrestricted file upload?

Unrestricted File Upload: The “unrestricted file upload” term is used in vulnerability databases and elsewhere, but it is insufficiently precise. The phrase could be interpreted as the lack of restrictions on the size or number of uploaded files, which is a resource consumption issue.