The vulnerability exists in the Online Faculty Clearance System 1.0 by SourceCodester, specifically in the Profile Picture Upload component's move_uploaded_file function in production/edit_picture.php. Manipulating the file argument enables unrestricted file upload, which can be exploited remotely. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no known active exploitation in the wild has been reported.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, potentially leading to unauthorized file storage on the server. This could facilitate further attacks depending on the server configuration and file handling, but the CVSS indicates limited impact on confidentiality, integrity, and availability.

No official patch or vendor advisory is provided for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions, validate and sanitize uploaded files, and consider disabling the vulnerable upload functionality if possible.