Executive brief
SourceCodester Online Book Store System 1.0 contains a security flaw in its administrative interface. An attacker with low-level access can manipulate web parameters to view internal system files that should be protected. This could lead to the exposure of sensitive configuration data or source code, potentially aiding further attacks against the bookstore's operations.
Technical details
A Local File Inclusion (LFI) vulnerability exists in SourceCodester Online Book Store System 1.0 within the Administrative Interface. The flaw is located in the /admin/index.php file, where the 'page' GET parameter is used in PHP include or require statements without sufficient validation. A remote attacker with authenticated access to the administrative panel can manipulate this parameter to traverse directories and include arbitrary local files. This can lead to the disclosure of sensitive information, such as system configuration files or application source code. An exploit for this vulnerability is publicly available.
Affected products
- SourceCodester Online Book Store System 1.0
Timeline
- 2026-07-13: advisory: NVD publication date