A critical unrestricted file upload vulnerability in the ProjectsAndPrograms School Management System enables remote, unauthenticated attackers to potentially compromise the application server.

This vulnerability involves an unrestricted file upload flaw within the /assets/createNotice.php file, where the File argument fails to implement sufficient validation. Because this is reachable by unauthenticated remote attackers, it provides a direct path for the injection of arbitrary files into the web environment.

The ability for an unauthenticated attacker to upload arbitrary files poses a severe risk of remote code execution, which could lead to total system compromise and unauthorized access to sensitive student or administrative data. With a CVSS score of 7.3, this high-severity flaw carries significant potential for data breach, service disruption, and long-term reputational damage to the educational institution.

Immediate Action: Since this product utilizes a rolling release model without specific versioned patches, administrators should restrict access to the /assets/createNotice.php file and monitor the vendor repository for the latest commit updates.

Proactive Monitoring: Review web server logs for suspicious file upload requests or attempts to access non-image file types in the assets directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads to the /assets/ directory and restrict access to the vulnerable endpoint by IP address if possible.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the public availability of exploit material and the lack of a traditional versioned patch, organizations must prioritize restricting access to the affected script immediately. Administrators should verify their current deployment against the latest available code from the vendor and apply security controls to prevent unauthorized uploads until a permanent fix is integrated into the rolling release.