A flaw in the move_uploaded_file function of SourceCodester Contact Tracing System 1.0 allows an attacker to manipulate the img/id parameter and upload files of any type, including potentially executable scripts. This lack of input validation gives an attacker the ability to place arbitrary content on the server, creating the possibility for remote code execution, data breach, or defacement. The vulnerability is classified under CWE‑434 and CWE‑284.

The only explicitly affected product is SourceCodester Contact Tracing System version 1.0. No other versions or editions are listed as impacted.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is currently not available. The vulnerability can be triggered remotely, as the upload functionality is exposed over HTTP. Although it is not recorded in CISA’s KEV catalog, the fact that the exploit is publicly disclosed increases the likelihood that attackers will target vulnerable installations. An attacker would craft a specially constructed request to the /classes/Users.php?f=save endpoint, supply a malicious payload through the img/id field, and rely on the fact that the server accepts and stores the file without restriction.