An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 allows attackers to execute arbitrary code via uploading a crafted file.
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')