An unrestricted file upload vulnerability in the College-Notes-Gallery application allows authenticated users to achieve remote code execution, posing a critical risk to server integrity.

The application fails to properly validate file types during the image upload process in the dashboard/userprofile.php file, allowing an authenticated attacker to bypass security checks by manipulating the Content-Type header. This flaw enables the upload and subsequent execution of malicious scripts, such as web shells.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying server. This leads to a complete compromise of the application environment, potentially resulting in unauthorized access to sensitive institutional data, the deployment of persistent backdoors, and total loss of system control. Given the potential for full system takeover, this vulnerability represents a severe threat to business continuity and data security.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the dashboard/userprofile.php endpoint or disable the file upload functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for suspicious file uploads or attempts to access unexpected .php files within the upload directories.

Compensating Controls: Implement strict server-side validation for file uploads and ensure that the directory where user-uploaded files are stored is configured to prevent the execution of scripts. A Web Application Firewall (WAF) can be used to block requests with suspicious Content-Type headers or file extensions.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's GitHub issue report.

Due to the critical nature of remote code execution, organizations currently utilizing this software must prioritize the mitigation of this vulnerability. Since the project utilizes a rolling release model and the vendor has not provided an official fix, users should consider the software insecure for production environments until the upstream repository implements robust server-side file validation.