Description

A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-15T04:18:19.700Z",
  "pubdate": "2026-09-15T04:18:19.700Z",
  "executiveSummary": "The College Notes Gallery Management System 1.0 contains an Unrestricted File Upload vulnerability located within the profile picture update functionality of the /dashboard/userprofile.php file. This security flaw allows an authenticated remote attacker to bypass file type validation mechanisms and upload arbitrary files, including malicious scripts, to the application's server.\nThe vulnerability poses a severe risk to the integrity, availability, and confidentiality of the host environment. By successfully uploading a web shell or other executable payloads, an attacker can achieve Remote Code Execution (RCE) on the underlying server. Given that the exploit code is currently public, the system is exposed to active exploitation by unauthorized actors. Immediate remediation is required to prevent server-side compromise, unauthorized data access, and potential lateral movement within the hosting infrastructure.",
  "technicalDetails": "The vulnerability resides in the component responsible for processing profile image uploads within the /dashboard/userprofile.php file. The application fails to implement robust server-side validation regarding the file extension, MIME type, or content integrity of the uploaded data. Specifically, the input passed through the 'image' argument is processed without sufficient filtering, allowing attackers to upload files with arbitrary extensions (e.g., .php, .phtml, .php5) instead of expected image formats like .jpg or .png.\nThe attack flow begins with the attacker accessing the user profile settings page. Upon selecting a malicious file—typically a web shell designed to interpret and execute server-side commands—the application accepts the file and writes it to the server's filesystem, often within a public-facing directory. Because the application lacks a mechanism to rename files, force random storage paths, or restrict execution permissions in the upload directory, the attacker can subsequently navigate to the location of the uploaded file to execute it.\nOnce the malicious file is accessed via a direct request, the server executes the script in the context of the web application user. This allows the attacker to execute system commands, traverse the directory structure, access database credentials, or exfiltrate sensitive student and faculty data stored within the College Notes Gallery Management System. The absence of file content verification, such as checking magic bytes or re-encoding the image to strip hidden payloads, serves as the root cause of the vulnerability. The attack is initiated remotely and does not require physical access to the server. Given that the exploit methodology is publicly available, threat actors can automate the discovery and compromise of instances running version 1.0 of the software. Post-exploitation impact ranges from full site defacement to a complete takeover of the server infrastructure, potentially resulting in further malicious activity originating from the compromised host."
}