The vulnerability in Visitor Management System 1.0 arises from insufficient validation of uploaded files in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is used without checking the MIME type, file extension, or file content, enabling an authenticated administrator to upload arbitrary PHP code. This can result in Remote Code Execution (RCE) on the affected server, compromising its integrity and confidentiality. No CVSS score or vendor advisory is available, and no patch links have been provided.

Successful exploitation allows an authenticated admin to upload a PHP webshell, resulting in Remote Code Execution on the server. This can lead to full compromise of the affected system, including unauthorized access, data theft, or further network pivoting. Since the vulnerability requires admin authentication, the threat is limited to users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and consider implementing additional file upload validation controls at the web server or application firewall level to block unauthorized file types.