This vulnerability in QueryMine sms affects the file admin/addteacher.php within the Background Management Page component. An attacker can remotely manipulate the 'image' parameter to perform unrestricted file uploads. This flaw allows potentially malicious files to be uploaded to the server, which could lead to further compromise depending on the file execution context. The issue affects the version identified by commit 7ab5a9ea196209611134525ffc18de25c57d9593. The vendor has not issued any patch or advisory, and no remediation level is specified. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload arbitrary files to the server via the 'image' parameter in admin/addteacher.php. This could lead to unauthorized code execution or other malicious activities depending on server configuration and file handling. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. There are no confirmed reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should consider implementing manual mitigations such as restricting file upload permissions, validating and sanitizing file inputs, or disabling the vulnerable functionality if possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.