The vulnerability lies in the SourceCodester E‑Learning System 1.0, specifically in the save_users function of /classes/Users.php. An attacker can manipulate the img parameter to upload an arbitrary file without any validation or restriction. The upload mechanism does not enforce file type checks or storage permissions, leaving the system susceptible to hosting malicious scripts or non‑image files. This flaw combines improper access control (CWE‑284) with an unvalidated file upload (CWE‑434), enabling a remote adversary to place executable code on the web server and potentially gain full control of the application or underlying host.

The affected product is SourceCodester's E‑Learning System, version 1.0. Any deployment of this version that exposes the save_users endpoint is vulnerable; the flaw exists in the code that handles photo uploads for user records.

The CVSS score of 6.9 denotes a medium‑high severity with a remote attack vector and local user privilege. Exploitation is feasible remotely without authentication, as the upload endpoint is publicly accessible. While no EPSS score is available, the publicly documented exploit demonstrates that attackers can already leverage this weakness. The system is not listed in the CISA KEV catalog, but the absence of a mitigation does not reduce the practical risk of successful exploitation.