The vulnerability exists in the Online Lot Reservation System 1.0 within the file /activity.php. An attacker can manipulate the directory argument to bypass the upload restrictions, resulting in unrestricted file uploads. This flaw maps to CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). An attacker could upload arbitrary files, including executable code or malicious scripts, into directories accessible via the web server. Depending on the server configuration, this could lead to remote code execution, data tampering, or disclosure of sensitive information. (These potential outcomes are inferred from the nature of the upload flaw and are not explicitly stated in the CVE description.)

The vulnerability affects code-projects Online Lot Reservation System version 1.0. The vulnerable component is the activity.php script which handles file uploads. The specific function responsible for directory validation has not been identified in the public disclosures, but the flaw exists in this version.

The CVSS score of 5.1 indicates a medium impact. EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the KEV catalog. Attack can be carried out remotely by sending crafted requests that modify the directory parameter to upload files to arbitrary locations. Because the upload restrictions are bypassed, attackers can place malicious files in the web root, with potential for code execution if the web server permits. (The specific code execution path is inferred and not explicitly confirmed.) The public disclosure and lack of patch information increases the risk that attackers might exploit this weakness.