Executive brief
mjperpinosa stumasy is a student management system and social networking platform. A security flaw in the profile image upload feature allows users to upload malicious files, such as scripts, instead of images. An attacker could use this to take control of the server, potentially leading to data theft or a complete shutdown of the service.
Technical details
An unrestricted file upload vulnerability exists in `application/PHP/objects/profiles/change_profile_image.php` within the mjperpinosa stumasy student management system. The root cause is flawed validation logic that uses an OR condition to check either the client-supplied MIME type or the file extension against a whitelist. An attacker can bypass this by forging the `Content-Type` header to a permitted image type (e.g., image/png) while uploading a file with a `.php` extension. The application then saves the file to a web-accessible directory (`/documents/images/`) with its original extension, allowing the attacker to execute arbitrary PHP code by requesting the uploaded file. As of the advisory date, the project has not responded to the issue report.
Affected products
- mjperpinosa stumasy rolling release
Timeline
- 2026-05-16: disclosed: Issue reported on GitHub repository
- 2026-06-04: advisory: CVE published by VulDB/NVD