A flaw in the File Extension Handler at /admin/addproduct.php of SourceCodester Simple POS and Inventory System 1.0 allows an attacker to manipulate the image argument to upload arbitrary files without restriction. The remote nature of the upload function means this vulnerability can be exploited from outside the system. If the uploaded files can be executed on the server (for example, script files), the attacker could gain control of the application or the underlying server.

Only the SourceCodester Simple POS and Inventory System version 1.0 is affected. No other versions or components are listed in the CNA data.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, but the existence of a published exploit demonstrates that the vulnerability is usable. The vulnerability is not listed in CISA KEV. Attack vectors are remote, through the web interface that accepts image uploads, making the flaw a realistic threat for deployments that expose this endpoint.