An unrestricted file upload vulnerability in the 1000projects Online Student Project Report Submission and Evaluation System allows remote, unauthenticated attackers to execute arbitrary file uploads.

The application fails to properly validate file uploads within the /admin/controller/student_controller.php file. An unauthenticated remote attacker can manipulate the new_image argument to upload arbitrary files to the server.

The ability to perform unrestricted file uploads presents a severe risk of remote code execution or server compromise. Successful exploitation could lead to full system takeover, unauthorized access to sensitive student data, or the deployment of malicious scripts, justifying the high CVSS score of 7.3.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected script or disable the upload functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/controller/student_controller.php and monitor the file system for unexpected files uploaded to the web directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious file extensions or malicious payloads directed at the vulnerable controller endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept, this vulnerability poses an immediate threat to the confidentiality and integrity of the hosting environment. Organizations using this software must treat this as a high-priority issue and apply strict access controls or disable the vulnerable component until an official security update is provided by the vendor.