CVE-2026-15540
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was found in SourceCodester Online Book Store System 1.0, involving uncontrolled file inclusion (Local File Inclusion) in /admin/index.php. By manipulating the 'page' argument, an attacker can remotely include arbitrary PHP files, leading to unauthorized data access or code execution.
Risk Assessment
The risk for the organization includes remote reading of sensitive configuration files, execution of malicious code, and potential takeover of the application, which could result in data leakage or complete system compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch that filters the 'page' argument and prevents inclusion of files outside the allowed directory. Additionally, implement input validation and restrict file permissions.
Other vulnerabilities in SourceCodester Online Book Store System
See all- CVE-2026-15539Medium
A vulnerability in SourceCodester Online Book Store System 1.0 allows unrestricted file upload via the book image upload feature in /admin/index.php?page=books. This can lead to remote code execution. The exploit is publicly available.
- CVE-2026-15537High
A SQL injection vulnerability has been discovered in SourceCodester Online Book Store System 1.0 in the file admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been publicly released.
- CVE-2026-15532Low
A cross-site scripting vulnerability was found in SourceCodester Online Book Store System 1.0 in the User Management Module. Manipulation of the Name or Username arguments allows remote script execution. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/require statement in php program. It is possible to initiate the attack remotely. The exploit is now public and may be used.