The vulnerability in SourceCodester Photo Share Website 1.0 involves an unrestricted upload flaw in the /social/ajax.php?action=save_upload endpoint. Attackers can manipulate the img[] and imgName[] parameters to upload arbitrary files without restriction. This flaw can be exploited remotely and has been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload arbitrary files to the server, which could lead to further compromise depending on the file type and server configuration. The impact is rated medium due to the potential for remote exploitation without authentication but with limited impact on confidentiality, integrity, and availability as per the CVSS vector.

No official patch or remediation is currently available. Users should monitor the vendor advisory for updates. Until a fix is released, consider implementing access controls on the upload functionality, validating and restricting file types, and deploying web application firewalls to detect and block malicious upload attempts.