This vulnerability (CWE-434) in Sensaway permits attackers with limited privileges to upload files without proper restriction on file types, leading to the potential upload of malicious web shells. This can result in full compromise of the web server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided a patch and has indicated inability to fix the issue due to outdated technology in the product.

Successful exploitation allows attackers to upload and execute arbitrary code on the web server, leading to complete system compromise including data theft, system manipulation, and denial of service. The vulnerability affects all versions of Sensaway as indicated. There are no known exploits in the wild at this time.

No official patch or fix is available from the vendor due to the product's outdated technology. Users should contact the manufacturer for guidance and strongly consider migrating to updated products developed with modern, secure technologies. Until migration, restrict access to the application and monitor for suspicious file uploads if possible.