A flaw in SourceCodester’s Onlne Examination & Learning Management System 1.0 allows a malicious actor to upload files with arbitrary names and extensions because the upload_files.php component calls PHP’s pathinfo() function without sanitizing the result. The uncontrolled filename can be manipulated so that malicious code is stored in a location the web application may later serve or execute, potentially leading to remote code execution or data exfiltration. The weakness corresponds to CWE‑284 (Improper Access Control) and CWE‑434 (Unvalidated Input / Improper File Type Checking).

The vulnerability is confined to the SourceCodester Onlne Examination & Learning Management System 1.0 release, specifically in the upload_files.php component. Any deployment running that exact version without a corrective update is impacted.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1 % suggests a low probability of widespread exploitation, and the flaw is not listed in the CISA KEV catalog. Remote exploitation is feasible through a crafted HTTP request to the publicly exposed upload endpoint, and the description implies that authentication is likely not required, meaning an unauthenticated attacker can trigger the upload process.