CVE-2026-15539: Book Store System Auth Bypass Vulnerability

CVE-2026-15539 Overview

CVE-2026-15539 affects SourceCodester Online Book Store System 1.0. The vulnerability resides in the Book Image Upload feature exposed through /admin/index.php?page=books. An authenticated attacker can abuse the upload handler to submit files without proper type or content restrictions. This weakness maps to [CWE-284] Improper Access Control and enables remote exploitation over the network. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations. The EPSS probability is 0.227% with a percentile of 13.492, reflecting current exploitation prediction data.

Critical Impact
An authenticated administrator-level attacker can upload arbitrary files through the book image upload handler, which public write-ups link to remote code execution on the hosting web server.

Affected Products

SourceCodester Online Book Store System 1.0
Deployments exposing /admin/index.php?page=books
Installations with the Book Image Upload feature enabled

Discovery Timeline

2026-07-13 - CVE-2026-15539 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15539

Vulnerability Analysis

The flaw sits in the administrative book management workflow of SourceCodester Online Book Store System 1.0. The Book Image Upload feature accepts files without enforcing server-side validation on extension, MIME type, or content signature. An attacker who holds valid administrator credentials can submit a file with an executable server-side extension in place of a book cover image. Once the file is written to a web-accessible directory, requesting its URL causes the interpreter to execute the attacker-controlled code. Public write-ups referenced by VulDB and the linked Medium article describe this exact path leading to authenticated remote code execution.

Root Cause

The root cause is improper access control combined with missing upload validation in the books administrative page. The application trusts the client-supplied file for the image field and stores it in a directory served by the PHP interpreter. There is no allowlist of image extensions, no verification of magic bytes, and no rewrite rule preventing script execution in the upload directory.

Attack Vector

Exploitation requires network access to the admin console and valid high-privilege credentials, which sets the attack complexity low but the privilege requirement high. The attacker navigates to /admin/index.php?page=books, submits a crafted .php payload through the book image field, and then issues an HTTP request to the resulting file path. The web server executes the payload in the context of the PHP process, yielding command execution on the host.

No verified proof-of-concept code is published in structured form. Refer to the Medium Article on RCE and VulDB CVE-2026-15539 for the disclosed technical walkthrough.

Detection Methods for CVE-2026-15539

Indicators of Compromise

POST requests to /admin/index.php?page=books containing multipart file fields with non-image extensions such as .php, .phtml, or .phar.
New files in the book image upload directory whose content begins with <?php or other script tags rather than image magic bytes.
Outbound connections or shell command execution originating from the PHP worker process shortly after an admin session uploads a book record.

Detection Strategies

Inspect web server access logs for GET requests to files inside the book image upload path where the extension is not a standard image type.
Correlate administrative logins with subsequent file writes to web-served directories that contain executable script extensions.
Deploy a web application firewall rule to flag multipart uploads where the declared Content-Type is image/* but the payload contains PHP tokens.

Monitoring Recommendations

Alert on any process spawn by the PHP-FPM or Apache worker that launches shells, wget, curl, or system enumeration binaries.
Track file integrity of the upload directory and generate events on any new script-extension file.
Monitor administrator account activity for logins from unusual source addresses followed by book record creation events.

How to Mitigate CVE-2026-15539

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlisting or a VPN until a fix is in place.
Rotate all administrator credentials and enforce strong, unique passwords to reduce the value of the required high-privilege access vector.
Audit the book image upload directory for unexpected files and remove any script-extension artifacts.

Patch Information

No vendor patch is referenced in the NVD entry or in the linked advisories at time of publication. Operators should track VulDB Vulnerability #377889 and the SourceCodester project page for updates. Until an official fix ships, apply the workarounds below.

Workarounds

Configure the web server to disable PHP execution inside upload directories, for example by dropping a .htaccess file that removes handler mappings or by using an Nginx location block that returns static content only.
Add server-side validation that checks file extension against an allowlist of .jpg, .jpeg, .png, and .gif, and verifies image magic bytes before persisting the file.
Rename uploaded files to a server-generated identifier without preserving the client-supplied extension.
Place the admin console behind an authenticating reverse proxy that enforces multi-factor authentication.

bash

# Nginx configuration example: deny script execution in the uploads directory
location ^~ /admin/uploads/ {
    location ~ \.(php|phtml|phar|php5|php7)$ {
        deny all;
        return 403;
    }
    default_type application/octet-stream;
}