This vulnerability affects SourceCodester Simple POS and Inventory System 1.0, specifically in the /admin/addproduct.php file within the file extension handler component. An attacker can manipulate the 'image' parameter to perform an unrestricted file upload, potentially allowing malicious files to be uploaded to the server. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Remote exploitation is possible without user interaction or elevated privileges. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, which may lead to further compromise depending on the nature of the uploaded files. The CVSS score of 5.3 reflects a moderate impact with low complexity and no required privileges or user interaction. However, the exact impact depends on how the uploaded files are handled post-upload by the application or server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable upload functionality, implement additional server-side validation of uploaded files, and monitor for suspicious uploads. Avoid exposing the /admin/addproduct.php endpoint to untrusted networks if possible.