This vulnerability exists in an unknown function within service/RegisterService.php of the Kushan2k student-management-system's Registration Endpoint. By manipulating the 'stimg' argument, an attacker can perform unrestricted file uploads remotely without any privileges or user interaction. The product's rolling release model complicates identification of affected or fixed versions. No official remediation or patch has been provided by the vendor as of the publication date. The exploit has been publicly disclosed, which may facilitate exploitation attempts.

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files to the system, potentially leading to further compromise such as code execution or data manipulation. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing temporary mitigations such as restricting access to the vulnerable endpoint, validating and sanitizing file uploads at network or application layers, or deploying web application firewalls to detect and block malicious upload attempts.