The vulnerability allows an attacker to manipulate the book_cover input parameter in upload_bookCover.php, leading to unrestricted file upload. This falls under CWE-434 (Unrestricted Upload of File) and potentially indicates a lack of adequate access controls (CWE-284). While the exploit demonstrates that arbitrary files can be uploaded from a remote location, the description does not confirm whether those files are subsequently executed by the application; the ultimate impact depends on how uploaded content is processed.

The vulnerable component is part of iJason-Liu Books_Manager, specifically the upload_bookCover.php controller. No specific fixed versions are listed; the product follows a rolling release model, and the advisory notes that version information for affected or updated releases is not available. Administrators should therefore consider all releases up to the commit 298ba736387ca37810466349af13a0fdf828e99c, and likely newer ones, as potentially vulnerable until a patch is supplied by the vendor.

With a CVSS base score of 5.1, the flaw is considered medium severity. The EPSS score is less than 1%, indicating a very low exploitation probability at the time of analysis. This vulnerability is not listed in the CISA KEV catalog, so there is no public record of active exploitation. The attack may be initiated remotely and is publicly known, suggesting that an attacker could attempt exploitation if the application is exposed to untrusted input.