I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (`tgz`, `jpg`, `png`, `pdf`, `zip`, `rar`, `txt`, `gif`, `py`, `c`, `rb`). In addition to that, I hash the filenames with md5 so e.g. when the user uploads the file `exploit.php.jpg` it is renamed to `526a8f9f3497b5a69bc4523ba0c6aacd.jpg`.

There is neither a MIME-Type verification nor a `getimagesize()` or resize-function, if it is a picture. Because of that it is possible to upload a php-file that is just renamed to exploit.jpg

Although this seems to be very risky and the user also knows, where this file exists on my server (`/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg`), I am not able to run this file as a .php.

When I try to open `/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg%00` or `/images/526a8f9f3497b5a69bc4523ba0c6aacd.php` and so on.. I only get "file not found" (for `.php`) or "image can not be displayed" (for `jpg`, `gif`).

Does anyone know if and *how* it is possible to exploit that fileupload?