The vulnerability is located in the Bulk Import feature of SourceCodester Student Result Management System 1.0, specifically the import_users.php handler. An attacker can manipulate the File argument to bypass built‑in access checks, enabling the upload of arbitrary files or the creation of user accounts without authentication. This weakness, based on CWE‑266 and CWE‑284, permits elevation of privileges and potential compromise of the system by injecting malicious code or unauthorized users.

SourceCodester Student Result Management System 1.0, sold through SourceCodester. The affected component is the admin core script import_users.php. No other versions are listed; the only published version at the time of disclosure is 1.0.

The CVSS score of 6.9 indicates moderate severity. EPSS is listed as <1%, reflecting a low but nonzero likelihood that this flaw will be actively exploited. The vulnerability is not catalogued in CISA’s KEV list, and public exploit code is available on GitHub, implying that an attacker can launch a remote exploit without authentication. Because the access control is insufficient, the attack vector is likely through the web interface to the bulk import endpoint.