The vulnerability resides in the upload_files.php handler of SourceCodester Online Examination & Learning Management System. The code incorrectly processes uploaded files, allowing an attacker to upload files of any type without restriction. This file‑type validation failure is reflected by CWE‑434 (Unrestricted Upload of File with Dangerous Type) and, combined with inadequate access control, CWE‑284. Such unrestricted uploads can be leveraged to place a webshell or other malicious payload into the application’s file system, potentially leading to remote code execution or other post‑exploitation actions.

SourceCodester Online Examination & Learning Management System, version 1.0. The CVE notes that the flaw exists in some unknown processing of the upload_files.php module; no other affected versions are listed.

The issue carries a CVSS score of 5.3, indicating a moderate severity. No EPSS value is available, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would likely exploit the flaw by accessing the web upload interface remotely, submitting a crafted file that bypasses the server’s content validation and writing it to a web‑accessible directory. If the uploaded file is executable (e.g., a PHP script), the attacker could gain remote code execution or other capabilities within the affected system.