A critical unrestricted file upload vulnerability in SourceCodester Online Exam Form Submission 1.0 allows unauthenticated remote attackers to upload arbitrary files, posing a significant risk of system compromise.

The application fails to properly validate file types during the registration process in register.php. This unrestricted upload vulnerability allows an unauthenticated remote attacker to bypass security controls and upload malicious files to the server.

The ability to upload arbitrary files to a web server typically leads to remote code execution, as attackers can upload web shells to gain full control over the application environment. This flaw presents a high risk of unauthorized data access, system defacement, or total server takeover. Given the CVSS score of 7.3, this issue is considered high severity due to the ease of exploitation and the potential for complete system compromise.

Immediate Action: As no official patch is currently available, administrators should immediately disable or restrict access to the registration functionality to prevent exploitation.

Proactive Monitoring: Review web server logs for suspicious file uploads, particularly those targeting the /register.php endpoint, and monitor for unexpected file creation in the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads that do not match expected file extensions or MIME types.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation at https://github.com/qcycop0101-hash/CVE/issues/18.

Due to the lack of an official patch and the availability of a public proof-of-concept, this vulnerability poses an immediate and elevated risk to all instances of SourceCodester Online Exam Form Submission 1.0. Organizations must treat this as a high priority and implement the suggested compensating controls immediately to prevent unauthorized access. Continued vigilance is required until the vendor provides a secure update to address the underlying file validation failure.