An unauthenticated remote file upload vulnerability in the Campcodes Online Student Enrollment System poses a significant risk of arbitrary code execution.

This flaw exists due to improper access controls and unrestricted file upload validation within the photo argument of the /admin/register.php file. The vulnerability is remotely exploitable by unauthenticated attackers.

The ability for an unauthenticated user to upload arbitrary files to the server can lead to full system compromise, as attackers may upload web shells to execute remote code. Given the CVSS score of 7.3, this represents a high severity risk that could result in unauthorized data access, system defacement, or total control of the underlying host environment.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should immediately restrict access to the /admin/register.php endpoint or disable the registration feature until a security update is released.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or attempts to access non-image file types within the upload directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block malicious file uploads and restrict access to administrative paths to trusted IP addresses only.

Public Exploit Available: Yes, a public proof of concept is available via the GitHub issue referenced in the vulnerability report.

This vulnerability is classified as high severity due to the potential for remote code execution via unrestricted file uploads. Organizations utilizing the Campcodes Online Student Enrollment System must treat this as a priority and implement strict network-level access controls or WAF rules immediately, as no official patch is currently available to resolve the underlying flaw.