I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png). The file gets uploaded with .png (not .php) extension. Is this vulnerable?
First off, you don't have to tamper with the request. Some PHP code could be simply written in EXIF fields or any other metadata field. Or even just bluntly added to the actual binary code of the image before upload.
It means that, in fact, uploading some PHP code is not big deal by itself. I would say most sites allowing image uploads allow it whatsoever. The question is how to activate it.
So to answer your question directly- nope, uploading a php code doesn't make a site vulnerable by itself. What are you looking for is another vulnerability, called LFI, or Local File Inclusion.