Critical File Upload Vulnerability: Web Shell Upload via Content-Type Validation Bypass

The application relied on the client-controlled Content-Type header during file upload validation. By modifying this header in the intercepted HTTP request, I was able to bypass the upload restrictions and successfully upload a server-side executable file.

After accessing the uploaded file, the server executed the payload, demonstrating the potential for Remote Code Execution (RCE).