The vulnerability involves an unrestricted file upload in the image argument of the edithousepic.php script of the Online Lot Reservation System. This flaw is a classic example of a CWE‑434 case, where the application accepts any file type without proper validation, and a CWE‑284 scenario, where insufficient access control allows arbitrary users to trigger the upload. An attacker can supply a malicious file (such as a PHP script) and place it in a writable web directory, enabling them to execute arbitrary code on the server. The impact therefore includes potential loss of confidentiality, integrity, and availability if a successful upload leads to remote code execution.

The affected product is code‑projects Online Lot Reservation System, version 1.0. All installations that include the edithousepic.php file exposed to user input are susceptible, regardless of the operating system or deployment environment.

The CVSS score of 5.1 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely against any exposed instance, and the exploit is publicly available. Because the flaw allows arbitrary file placement within a web accessible directory, the risk to systems that host the application is considerably high if no mitigation is applied.