A flaw in PHPEMS version 11.0 occurs in the temppage function of the /app/exam/controller/exams.master.php file. The uploadfile parameter is not properly validated, allowing an attacker to supply arbitrary values that cause the application server to issue HTTP requests to any target URL. This Server‑Side Request Forgery can be triggered remotely, which enables a remote attacker to force the server to access external or internal resources.

PHPEMS 11.0 is affected; the vulnerability resides in the Instant Exam Creation Handler component, specifically the temppage endpoint that processes the uploadfile argument.

The reported CVSS score of 5.3 places the issue in the medium severity range. EPSS data is not available, but the public availability of exploit code suggests that the flaw is likely to be used by threat actors. The attack can be carried out from outside the network because it only requires sending an HTTP request to the PHPEMS instance. Based on typical SSRF behavior, an attacker might be able to retrieve data from internal services if the server’s outbound policy does not restrict access, or otherwise direct traffic to arbitrary destinations. The vulnerability is not listed in the CISA KEV catalog, yet its remote nature and public exploit code warrant prompt remediation.