Description:
------------
---
From manual page: https://php.net/function.mime-content-type
---
The mime_content_type() function will return the type of file but only check the first N bytes for the mime type.
Using the mimetype command from command line will return a different type.
The negative scenario is one in which someone creates a malicious file by injecting the first bytes to allow the function to recognize the file as expected (for example as .pdf) but the real type of the file is another.

Test script:
---------------
$file1="real_pdf.pdf";
$file2="real_php.pdf";
$file3="fake_pdf_with_php.pdf";
$finfo = finfo_open(FILEINFO_MIME_TYPE);
echo $file1." mime_content_type: ".mime_content_type($file1)." finfo_file: ".finfo_file($finfo, $file1)." syscall: ".system('/usr/bin/mimetype '.$file1)."\r\n";
echo $file2." mime_content_type: ".mime_content_type($file2)." finfo_file: ".finfo_file($finfo, $file2)." syscall: ".system('/usr/bin/mimetype '.$file2)."\r\n";
echo $file3." mime_content_type: ".mime_content_type($file3)." finfo_file: ".finfo_file($finfo, $file3)." syscall: ".system('/usr/bin/mimetype '.$file3)."\r\n";


Expected result:
----------------
real_pdf.pdf mime_content_type: application/pdf finfo_file: application/pdf syscall: real_pdf.pdf: application/pdf
real_php.pdf mime_content_type: text/x-php finfo_file: text/x-php syscall: real_php.pdf: application/x-php
fake_pdf_with_php.pdf mime_content_type: application/x-php finfo_file: application/x-php syscall: fake_pdf_with_php.pdf: application/x-php


Actual result:
--------------
real_pdf.pdf mime_content_type: application/pdf finfo_file: application/pdf syscall: real_pdf.pdf: application/pdf
real_php.pdf mime_content_type: text/x-php finfo_file: text/x-php syscall: real_php.pdf: application/x-php
fake_pdf_with_php.pdf mime_content_type: application/pdf finfo_file: application/pdf syscall: fake_pdf_with_php.pdf: application/x-php