| 제목 | SourceCodester College Notes Gallery Management System using PHP with Source Code 1.0 Unrestricted Upload |
|---|
| 설명 | During the security review of "College Notes Gallery Management System V1.0", I found that the profile upload function in dashboard/userprofile.php accepts attacker-controlled file metadata and stores uploaded content inside a publicly reachable directory.
The application validates the upload only by checking the MIME type reported by the client and by limiting file size. It does not inspect the real file content, does not block dangerous extensions, and does not store the file outside the web root.
When a user uploads a file named shell.php with a forged image MIME type, the server saves it as a .php file under dashboard/profilepics/. Visiting that file in the browser executes the embedded PHP payload, confirming remote code execution.
This issue is exploitable by any authenticated low-privilege account; administrative access is not required. |
|---|
| 원천 | ⚠️ https://github.com/OnlyCMJB/cve/issues/1 |
|---|
| 사용자 | OnlyCMJB (UID 100094) |
|---|
| 제출 | 2026. 08. 13. PM 12:59 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 14. AM 07:51 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403414 [SourceCodester College Notes Gallery Management System 1.0 Profile Upload userprofile.php image 권한 상승] |
|---|
| 포인트들 | 20 |
|---|