This vulnerability arises from the use of move_uploaded_file in the register.php script, where the photo parameter is not properly validated. An attacker can supply arbitrary file data, resulting in unrestricted upload. When the uploaded file contains executable code or a web script, the attacker may gain remote code execution or broader system compromise. The weakness involves improper access control (CWE-284) and uncontrolled upload due to missing file type restrictions (CWE-434).

itsourcecode Online Pharmacy System version 1.0 is affected. No additional affected versions were listed.

The CVSS score of 6.9 indicates medium severity. EPSS score is not reported, but the vulnerability is publicly documented and exploitable. It is not listed in CISA's KEV catalogue. The attack vector is remote, likely through an HTTP request to the register page, and it does not require authentication. Once the attacker uploads a malicious payload, they may execute code with the application's privileges or cause unintended behavior.