The vulnerability originates from an unvalidated use of the PHP function move_uploaded_file within upload.php. An attacker can supply malicious file content via the File argument, bypassing any checks on MIME type, extension, or size. This flaw falls under CWE‑284 (Improper Control of Access Permissions) and CWE‑434 (Unrestricted Upload of File with Dangerous Type). If an attacker uploads a file that the web server can execute—such as a PHP script—this could lead to arbitrary code execution, data tampering, or denial of service of the application.

The affected product is Cyber‑III Student‑Management‑System. No specific version information is available from the CVE; the issue was reported against the code base as of the identifier 1a938fa61e9f735078e9b291d2e6215b4942af3f, but no repaired release has been published. Therefore, all deployments of the system that have not been manually patched or upgraded are potentially vulnerable.

The CVSS score of 5.3 indicates moderate risk, and the vulnerability is not listed in the CISA KEV catalog. It is explicitly stated that the attack can be initiated remotely through the web interface, implying that remote attackers can exploit the flaw by crafting a request to upload a file. The lack of file validation and the write permission of the upload directory give an attacker the ability to place arbitrary files on the server. If the upload directory is web‑exposed or executable, the attacker could execute code, thereby compromising confidentiality, integrity, and availability of the application. The EPSS score is not available, but the publicly released exploit suggests a realistic likelihood of exploitation.