Executive brief
SourceCodester College Notes Gallery Management System is a web application for managing college notes and image galleries. An authenticated attacker can upload a malicious PHP file by forging the file type, allowing remote code execution on the web server and full compromise of the application.
Technical details
This is an unrestricted file upload vulnerability in the profile image upload handler at dashboard/userprofile.php. The root cause is insufficient server-side validation: the application only checks the client-supplied MIME type from $_FILES['image']['type'] against an allowlist and derives the filename extension from the original upload name using pathinfo(), without inspecting actual file content or blocking dangerous extensions. An authenticated attacker can upload a file named shell.php with a forged Content-Type header (e.g., image/jpeg), causing the application to store it as executable PHP in the publicly accessible profilepics/ directory. When the uploaded file is accessed via HTTP, the PHP payload executes in the web server context. No administrative privileges are required; any authenticated user can exploit this vulnerability.
Affected products
- SourceCodester College Notes Gallery Management System 1.0
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on GitHub
- 2026-09-15: advisory: CVE-2026-90857 published