The .htaccess that made JPEGs run as PHP
An .htaccess file in the uploads folder tells Apache to run .jpg files as PHP. Find it, the uploaded “image” that abused it, and the commands passed in its query string.
Briefing
Avatar uploads are checked by extension: only .jpg and .png are allowed. That check is fine as long as the server never executes those files.
Apache reads .htaccess files in every directory when AllowOverride permits it. AddType or AddHandler there can change how a file extension is handled.
community-01 · Web config review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.