This vulnerability affects SourceCodester Onlne Examination & Learning Management System 1.0. An attacker can exploit an unrestricted upload flaw by manipulating the user_id parameter in the /process_lesson.php script. This allows remote attackers to upload files without proper restrictions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch available at this time, and the exploit code is publicly available.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file placement on the server. This could facilitate further attacks such as code execution or defacement depending on server configuration and file handling. The vulnerability requires low attack complexity and no user interaction, but some privileges are needed (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected script and validate or sanitize user inputs related to file uploads. Implement web application firewall rules to detect and block malicious upload attempts.