CVE-2026-15540: Book Store System RCE Vulnerability

CVE-2026-15540 Overview

CVE-2026-15540 is a Local File Inclusion (LFI) vulnerability in SourceCodester Online Book Store System 1.0. The flaw exists in the /admin/index.php file within the Administrative Interface component. Attackers can manipulate the page parameter to control the filename passed to a PHP include or require statement. The issue is classified under CWE-73: External Control of File Name or Path.

The vulnerability is remotely exploitable and requires low-privilege authentication. Public exploit details are available, increasing the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Authenticated attackers can disclose source code and sensitive server-side files by manipulating the page parameter, potentially exposing credentials, configuration data, and application logic.

Affected Products

SourceCodester Online Book Store System 1.0
/admin/index.php (Administrative Interface component)
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2026-07-13 - CVE-2026-15540 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15540

Vulnerability Analysis

The vulnerability originates in the administrative interface of SourceCodester Online Book Store System 1.0. The /admin/index.php script accepts a page GET parameter that determines which file to include for rendering the requested view. The application fails to validate or sanitize this parameter before passing it to a PHP include or require statement.

An authenticated attacker can supply traversal sequences or arbitrary filenames through the page parameter to load files outside the intended directory. This results in source code disclosure and potential exposure of configuration files containing database credentials. Because PHP interprets included files, attackers may also chain the flaw with file upload weaknesses or log poisoning techniques to escalate toward code execution.

The attack surface is exposed over the network and requires only low-privilege administrative panel access. Public documentation of the exploitation technique lowers the barrier for reproducing the attack.

Root Cause

The root cause is improper control of the filename used in an include/require statement, mapped to [CWE-73]. The page parameter is concatenated directly into the include path without allowlist validation, canonicalization, or extension restriction. This design flaw permits path traversal and inclusion of unintended local resources.

Attack Vector

An attacker with access to the administrative interface sends a crafted HTTP request to /admin/index.php with a manipulated page value. Traversal sequences such as ../ combined with a target file path allow the PHP interpreter to include arbitrary local files. Depending on server configuration, the attacker retrieves the file contents in the HTTP response, disclosing PHP source, configuration data, or system files readable by the web server user.

// The vulnerability manifests when the page parameter is included without validation.
// See the referenced Medium write-up for a technical walkthrough of the exploitation path:
// https://medium.com/@hemantrajbhati5555/local-file-inclusion-lfi-via-page-parameter-leading-to-source-code-disclosure-ce722de0c407

Detection Methods for CVE-2026-15540

Indicators of Compromise

HTTP requests to /admin/index.php containing traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f) in the page parameter
Access log entries showing page= values referencing sensitive filenames such as config, .env, wp-config, or /etc/passwd
Unusual web server file read errors or PHP warnings referencing missing include targets

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the page query parameter for path traversal patterns and PHP wrappers (php://, file://, data://)
Correlate authenticated admin sessions with anomalous request volumes against /admin/index.php to surface parameter fuzzing
Ingest PHP and web server error logs into a centralized analytics platform and alert on include/require failures

Monitoring Recommendations

Monitor administrative panel authentication events for brute-force or credential-stuffing behavior that could precede exploitation
Track outbound connections and file access from the PHP process to detect post-exploitation data exfiltration
Alert on any request where the page parameter contains a filesystem separator, null byte, or non-alphanumeric characters

How to Mitigate CVE-2026-15540

Immediate Actions Required

Restrict access to /admin/index.php using network-level controls, IP allowlisting, or VPN-only exposure
Rotate any credentials, API keys, or secrets that may have been stored in files reachable through the include path
Review web server access logs since deployment for signs of prior exploitation of the page parameter

Patch Information

No vendor patch has been referenced in the advisory data for SourceCodester Online Book Store System 1.0. Administrators should treat the application as unpatched and apply the workarounds below. Additional context is available in the VulDB CVE-2026-15540 entry and the Medium write-up on LFI via the page parameter.

Workarounds

Implement a strict allowlist of permitted page values inside /admin/index.php and reject any input outside that set
Disable allow_url_include and set open_basedir in the PHP configuration to constrain filesystem access
Sanitize the page parameter by stripping directory separators, null bytes, and forcing a fixed file extension before passing to include
Consider migrating off the affected application if it is no longer maintained

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Example nginx rule blocking traversal in the page parameter
# location /admin/ {
#     if ($arg_page ~* "(\.\./|\.\.\\|%2e%2e|php://|file://|data://)") {
#         return 403;
#     }
# }