Executive brief
A security vulnerability exists in the CollegeManagementSystem, a platform used by engineering colleges to manage student records and academic data. An attacker can bypass file upload restrictions to place malicious scripts on the server. If exploited, this allows the attacker to take full control of the web server, potentially leading to the theft of student data, service disruption, or further attacks on the institution's network.
Technical details
An unrestricted file upload vulnerability exists in `dashboard_page/forms/upload_student_data.php` due to insufficient validation of the `Student-Data-CSV` parameter. The application relies solely on the client-provided `Content-Type` header (checking for `application/csv`) and uses `PATHINFO_EXTENSION` to determine the final filename without verifying against a whitelist. An authenticated attacker can upload a PHP shell by forging the MIME type and appending a `.php` extension. Because the upload directory is web-accessible and allows script execution, the attacker can execute arbitrary code by requesting the uploaded file.
Affected products
- tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3
Timeline
- 2026-05-18: disclosed: Issue reported on GitHub repository
- 2026-06-05: advisory: CVE published by VulDB/NVD