The Exam Form Submission application contains an unrestricted file upload vulnerability that allows unauthenticated remote attackers to execute arbitrary code on the host server.

This flaw is an unrestricted file upload vulnerability (CWE-434) located in the register.php file, where the image argument lacks proper validation, allowing an unauthenticated attacker to upload malicious files.

Successful exploitation of this vulnerability can lead to full system compromise, as the ability to upload arbitrary files often permits the execution of web shells. Given the CVSS score of 7.3, this represents a significant risk to data integrity and server availability, potentially resulting in unauthorized access to sensitive exam data or complete server takeover.

Immediate Action: As no official patch is currently available, administrators should restrict access to register.php or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review server logs for suspicious file uploads or access patterns targeting register.php, and monitor web directories for unexpected executable files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads that do not conform to expected image file extensions and MIME types.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the research write-up at https://github.com/Dingzenggonpo/cve/issues/4.

The severity of this flaw necessitates immediate attention, as it provides a clear path for remote attackers to gain unauthorized control over the application environment. Since no official patch is verified, proactive measures such as file system permissions hardening and strict WAF filtering are mandatory to prevent exploitation while awaiting a vendor resolution.