An unauthenticated remote code execution risk exists in the ProjectsAndPrograms School Management System due to an unrestricted file upload vulnerability.

The application fails to properly validate file uploads within the /assets/changeSllyabus.php script. An unauthenticated attacker can supply a malicious payload via the File argument to achieve an unrestricted file upload.

The ability for an unauthenticated attacker to upload arbitrary files poses a critical risk to the confidentiality, integrity, and availability of the system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive student records and administrative data. With a CVSS score of 7.3, this represents a high-severity threat that requires immediate attention to prevent unauthorized remote control.

Immediate Action: As there is no official patch currently available, administrators should immediately restrict access to the /assets/changeSllyabus.php endpoint at the network or web server level.

Proactive Monitoring: Monitor web server access logs for requests directed at /assets/changeSllyabus.php and inspect the /assets/ directory for any unauthorized or suspicious file uploads.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized POST requests to the vulnerable endpoint and restrict file uploads to verified, trusted users only.

Public Exploit Available: Yes — a public proof-of-concept exists as referenced in the GitHub issue tracker (https://github.com/qqy-123/cve/issues/3).

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a significant risk to affected organizations. Security teams should prioritize isolating the vulnerable component and implementing strict access controls to prevent exploitation. Continuous monitoring for indicators of compromise is essential until a formal fix is released by the vendor.