SourceCodester Online Book Store System Local File Inclusion Vulnerability Allowing Source Code Disclosure

A local file inclusion vulnerability has been identified in SourceCodester Online Book Store System version 1.0. The issue resides in the administrative interface, specifically within the file '/admin/index.php'. The vulnerability arises because the application improperly validates user-supplied input in the 'page' parameter, allowing remote attackers to manipulate file inclusion requests. Exploitation of this vulnerability enables the reading of arbitrary PHP source files from the application directory, with the potential to disclose sensitive server-side code.

Impact

Exploitation of this vulnerability allows for arbitrary file read operations, enabling the disclosure of PHP source code from the application. This could expose authentication and authorization logic, database interaction details, and other sensitive information, potentially leading to further application compromise.

Reproduction

To reproduce this vulnerability, authenticate to the administrative panel of the Online Book Store System. Once authenticated, navigate to '/admin/index.php' and modify the 'page' parameter to include a payload that leverages the PHP stream wrapper 'php://filter/convert.base64-encode/resource='. Target a file such as 'admin_class.php' to read its contents. After submitting the request, the server will respond with the Base64-encoded source code, which can be decoded to reveal the complete file contents.

Remediation

Implement strict allow-list validation for file inclusion operations, avoid using user-controlled input directly in include/require statements, disable unnecessary PHP stream wrappers, restrict accessible files to predefined application pages, validate and sanitize all file inclusion parameters, and apply centralized access control checks for administrative functions.