| शीर्षक | SourceCodester Resort Reservation System (PHP + SQLite3) 1.0 Local File Inclusion |
|---|
| विवरण | The Resort Reservation System application is vulnerable to Local File Inclusion (LFI) due to improper handling of user-supplied input in the page parameter.
The application directly incorporates the page parameter into a PHP include() statement without validation or sanitization:
$page = $_GET['page'] ?? 'home';
include($page . ".php");
An authenticated attacker can manipulate the page parameter to include unintended files using PHP stream wrappers such as php://filter. This allows disclosure of sensitive source code files by bypassing the enforced .php extension through encoding filters. |
|---|
| स्रोत | ⚠️ https://medium.com/@cybertamarin/local-file-inclusion-in-a-php-reservation-system-from-parameter-abuse-to-source-code-disclosure-f1ac55dd6178 |
|---|
| उपयोगकर्ता | Antony Esthak Twinson (UID 96471) |
|---|
| सबमिशन | 27/03/2026 03:27 PM (6 महीनों पहले) |
|---|
| संयम | 08/04/2026 09:13 PM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 236234 [SourceCodester Resort Reservation System 1.0 index.php page अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|