Executive brief
The SourceCodester Leave Application System, a web application used for managing employee time-off requests, contains a security flaw that allows unauthorized users to access internal files. By manipulating web addresses, an attacker can view sensitive system information or potentially disrupt operations. This could lead to the exposure of private data or provide a foothold for further attacks on the organization's network.
Technical details
A local file inclusion (LFI) vulnerability exists in SourceCodester Leave Application System 1.0. The flaw is located in the handling of the 'page' argument, where the application fails to properly validate or sanitize user-supplied input before using it in file inclusion functions. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to include local files on the server. This can lead to the disclosure of sensitive information, such as configuration files or system credentials, and in some configurations, may lead to remote code execution. The exploit is currently public.
Affected products
- SourceCodester Leave Application System 1.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory