This vulnerability exists in the SourceCodester Photo Share Website 1.0 within the ajax.php script that processes images. The flaw allows an attacker to manipulate the img[]/imgName[] parameters to upload files without any type or content validation. Because the application accepts any file and stores it in a web‑accessible directory, the attacker could upload a malicious script or binary that, if executed by the web server, would enable remote code execution. This represents a moderate severity security flaw.

The affected product is SourceCodester Photo Share Website version 1.0. No other versions are provided in the CNA data, so the issue appears specific to that publicly released version.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and occurs through the /social/ajax.php?action=save_upload endpoint, which can be accessed externally. While the description states that the flaw can be exploited remotely, the exact requirement for successful code execution depends on the server’s configuration; it is inferred that if the uploaded script resides in an executable location, an attacker could execute it. The lack of a KEV listing suggests limited current exploit activity, but the unrestricted upload remains a significant risk.