The SourceCodester Online Book Store System includes a Book Image Upload feature accessed through the /admin/index.php?page=books endpoint. The upload handler does not validate the MIME type or file extension, allowing an attacker to upload arbitrary files. Based on the description, it is inferred that the attacker could upload executable code and potentially achieve remote code execution. The flaw arises from a combination of untrusted file upload (CWE-434) and insufficient access control (CWE-284).

Only the install of SourceCodester Online Book Store System 1.0 is explicitly listed as affected. No further sub‑components or patch levels are mentioned, and the vulnerability is tied to the book image upload function in the administrative module.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low current chance of exploitation. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in the wild. The description confirms that the attack can be performed remotely, though authentication requirements are not specified; it is thus inferred that attackers may need administrative credentials to reach the upload interface, which would elevate the overall risk if the system is compromised.