This vulnerability exists in the storeProfileImage function of the student_profile_pic.php file within the Shared Upload Helper component of the imranrisal-dev Student-Management-System. By manipulating the choose_file argument, an attacker can upload arbitrary files without restriction. The vulnerability can be exploited remotely and has been publicly disclosed. Due to the rolling release nature of the product, no explicit version information for affected or fixed releases is available. The vendor did not respond to early contact attempts regarding this issue. No patch or official remediation level has been provided.

Successful exploitation allows an attacker to upload arbitrary files to the system remotely, potentially leading to unauthorized code execution or other malicious actions depending on the uploaded file and system configuration. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. Until a fix is released, consider restricting file upload functionality, validating and sanitizing uploaded files, and applying compensating controls to limit potential impact.