| Название | SourceCodester College Notes Gallery Management System using PHP with Source Code 1.0 Unrestricted Upload |
|---|
| Описание | During the security review of "College Notes Gallery Management System V1.0", I found that the profile upload function in dashboard/userprofile.php accepts attacker-controlled file metadata and stores uploaded content inside a publicly reachable directory.
The application validates the upload only by checking the MIME type reported by the client and by limiting file size. It does not inspect the real file content, does not block dangerous extensions, and does not store the file outside the web root.
When a user uploads a file named shell.php with a forged image MIME type, the server saves it as a .php file under dashboard/profilepics/. Visiting that file in the browser executes the embedded PHP payload, confirming remote code execution.
This issue is exploitable by any authenticated low-privilege account; administrative access is not required. |
|---|
| Источник | ⚠️ https://github.com/OnlyCMJB/cve/issues/1 |
|---|
| Пользователь | OnlyCMJB (UID 100094) |
|---|
| Представление | 13.08.2026 12:59 (1 месяц назад) |
|---|
| Модерация | 14.09.2026 07:51 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 403414 [SourceCodester College Notes Gallery Management System 1.0 Profile Upload userprofile.php image эскалация привилегий] |
|---|
| Баллы | 20 |
|---|