This vulnerability affects the Online Lot Reservation System 1.0 by code-projects. It arises from improper validation of the 'directory' argument in the /activity.php file, allowing an attacker to upload files without restriction. The attack vector is remote network access with low attack complexity and no user interaction required. The CVSS 4.0 base score is 5.1, indicating medium severity with limited confidentiality, integrity, and availability impacts. No official fix or patch is currently documented.

Successful exploitation allows an attacker with high privileges to upload arbitrary files remotely, potentially leading to unauthorized file placement on the server. This could facilitate further attacks depending on the uploaded content. However, the impact on confidentiality, integrity, and availability is rated low to limited. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious upload activity. Consider implementing web application firewall rules to block unauthorized upload attempts targeting the /activity.php file's directory parameter.