The vulnerability exists in the storeProfileImage function of student_profile_pic.php, where an attacker can manipulate the choose_file argument to upload any file type without restriction. Based on the description it is inferred that the attacker could upload arbitrary files, potentially including malicious scripts or binaries, that might be executed on the server, leading to remote code execution, defacement, or data exfiltration. This flaw can enable the placement of malicious scripts or binaries on the web server, creating a route for remote code execution, defacement, or data exfiltration. The weakness aligns with CWE‑434 and CWE‑284, indicating improper file type validation and unauthorized access control to the upload mechanism.

The affected product is the Student-Management-System developed by imranrisal-dev. No fixed or released version numbers are available due to the product’s rolling‑release model, but any installation using this component is potentially vulnerable.

The CVSS score of 5.3 indicates a moderate risk level, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attacker can perform the exploit remotely via a web request containing a crafted choose_file parameter, and the flaw has already been publicly disclosed. Because the vendor did not respond to notification, the risk of exploitation remains high for unpatched systems, especially if upload controls are not manually enhanced. The vendor’s lack of response is inferred to increase the likelihood of exploitation.