| 标题 | SourceCodester College Notes Gallery Management System using PHP with Source Code 1.0 Unrestricted Upload |
|---|
| 描述 | During the security review of "College Notes Gallery Management System V1.0", I found that the profile upload function in dashboard/userprofile.php accepts attacker-controlled file metadata and stores uploaded content inside a publicly reachable directory.
The application validates the upload only by checking the MIME type reported by the client and by limiting file size. It does not inspect the real file content, does not block dangerous extensions, and does not store the file outside the web root.
When a user uploads a file named shell.php with a forged image MIME type, the server saves it as a .php file under dashboard/profilepics/. Visiting that file in the browser executes the embedded PHP payload, confirming remote code execution.
This issue is exploitable by any authenticated low-privilege account; administrative access is not required. |
|---|
| 来源 | ⚠️ https://github.com/OnlyCMJB/cve/issues/1 |
|---|
| 用户 | OnlyCMJB (UID 100094) |
|---|
| 提交 | 2026-08-13 12時59分 (1 月前) |
|---|
| 管理 | 2026-09-14 07時51分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 403414 [SourceCodester College Notes Gallery Management System 1.0 Profile Upload userprofile.php image 权限提升] |
|---|
| 积分 | 20 |
|---|