CVE-2026-11333

Vulnerability

A security vulnerability exists in the Student Data Upload Endpoint of tittuvarghese CollegeManagementSystem, specifically within dashboard_page/forms/upload_student_data.php. The component performs a superficial MIME-type check that relies on the client-supplied Content-Type header, allowing an attacker to bypass it. The file extension is also taken directly from the user-supplied filename without validation. The project uses a rolling release model, so specific affected and updated versions are not detailed.

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attacker needs to craft a PHP payload and submit a multipart POST request to upload_student_data.php. The request should include the necessary student data parameters and the PHP file in the Student-Data-CSV field, with the Content-Type header set to application/csv and the filename appended with .php (e.g., shell.php). Although the server may return a CSV format error, the file will be stored on disk.

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) by uploading a web shell. The server stores the uploaded file in the web-accessible dashboard_page/forms/uploads/ directory under a predictable filename derived from other form fields. The attacker can then access this file directly via a URL to execute arbitrary PHP code on the server.

Mitigation

This vulnerability has been publicly disclosed, and the project was informed early via an issue report but has not yet responded. As the project uses a rolling release model and version details are unavailable, a specific patched version is not identified. No workarounds or EOL status are mentioned in the available references. The project has not yet released a fix or responded to the vulnerability report [1], [2].