QueryMine SMS contains an unrestricted file upload flaw in admin/addteacher.php due to insufficient validation of the image argument. This flaw corresponds to CWE‑284 and CWE‑434 and enables an attacker to upload arbitrary files that may be executed or used for further compromise. The description indicates that the attack can be launched remotely; based on the description, it is inferred that the attacker would manipulate the image argument in a crafted POST request to the upload endpoint. The exploit can lead to remote code execution, data leakage, or defacement if the uploaded file is executed by the server.

All deployments of QueryMine SMS based on or prior to the commit 7ab5a9ea196209611134525ffc18de25c57d9593 are potentially affected. The product does not use versioning, so no specific release numbers can be cited; any instance that includes the Background Management Page (admin/addteacher.php) is at risk.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, but public exploit releases and the vendor’s lack of response increase the risk. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw allows remote upload of arbitrary files, it is a high‑impact attack surface that can be abused even if the attacker does not achieve immediate code execution; the upload can facilitate social engineering or serve as a foothold for later stages of compromise.