#!/usr/bin/env bash
# Vector 15: File Upload Vulnerabilities
# Desc: Unrestricted file upload, path traversal in upload
# Detect: Upload forms, multipart endpoints
# Severity: HIGH
# Tools: curl

vector_fileup() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing File Upload vectors..."
  
  # Find upload endpoints
  local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
  local upload_urls=$(echo "$page" | grep -oiP 'action="[^"]*upload[^"]*"\|enctype="multipart/form-data"' | head -5)
  
  if [ -n "$upload_urls" ]; then
    print_info "Upload form detected, testing restrictions..."
    
    # Try uploading a PHP shell (harmless test)
    local test_content='<?php echo "UPLOAD_TEST"; ?>'
    local tmpfile=$(mktemp)
    echo "$test_content" > "$tmpfile"
    
    local response=$(curl -s --connect-timeout 5 --max-time 10 \
      -F "file=@${tmpfile};filename=test.php" \
      -F "file=@${tmpfile};filename=test.php.jpg" \
      -F "file=@${tmpfile};filename=test.png;type=image/png" \
      "$target" 2>/dev/null)
    
    rm -f "$tmpfile"
    
    if echo "$response" | grep -qi "uploaded\|success\|200\|stored"; then
      print_find "File Upload Vulnerability!" "PHP file accepted as upload"
      echo "SEVERITY: HIGH
VECTOR: Unrestricted File Upload
DETAIL: Server accepted PHP file upload on $target
EVIDENCE: Upload response indicates success
EXPLOIT: Upload PHP web shell for RCE" > "$REPORTS_DIR/.finding_$(date +%s)_fileup.txt"
      findings=$((findings + 1))
    fi
  else
    print_skip "No upload forms detected"
  fi
  
  return $findings
}