Executive brief
College-Notes-Gallery is a web application for sharing and managing college course notes. An attacker can upload arbitrary files including malicious PHP scripts by bypassing weak content-type validation, leading to remote code execution and full server compromise. The vulnerability requires only network access and affects the administrative dashboard.
Technical details
The /dashboard/userprofile.php?section=admin1 endpoint validates uploaded files only by checking the Content-Type header against a whitelist (image/gif, image/jpeg, image/pjpeg, image/png) without inspecting actual file content or extension. An attacker can craft a multipart request with a PHP payload, set a spoofed image Content-Type header, and bypass validation to upload a webshell. This enables remote code execution with the privileges of the web server process.
Affected products
- anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6
Timeline
- 2026-07-20: disclosed
- 2026-09-22: advisory