A vulnerability in code-projects Online Bidding System 1.0 allows remote attackers with high privileges to perform unrestricted file uploads via the categoryadd function in /administrator/addcategory.php. This weakness can lead to limited confidentiality, integrity, and availability impacts. Public exploit code is available.