An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-46013
• https://www.exploit-db.com/exploits/50587