File Upload Vulnerabilities

Secondly, file-type checking is done in JavaScript.

A hacker
example.com/profile/edit
A file chooser dialog
YOUR PROFILE
An anonymous profile
 USERNAME
Mal