| Título | SourceCodester Resort Reservation System (PHP + SQLite3) 1.0 Local File Inclusion |
|---|
| Descrição | Local File Inclusion (LFI) via page Parameter
Severity: Critical
CWE: CWE-98 — Improper Control of Filename for Include/Require Statement
Authentication: Required (any authenticated user)
Affected File: index.php
Relevant Code
$page = $_GET['page'] ?? 'home';
include($page . ".php");
Description
The application directly passes the user-controlled page parameter into the include() function without validation or allowlisting.
An attacker can abuse PHP stream wrappers such as php://filter to read sensitive files on the server. Using the base64-encoding filter bypasses the enforced .php extension and allows disclosure of application source code.
Impact
An authenticated attacker can read arbitrary PHP source files including:
• DBConnection.php
• Master.php
• auth.php
• login.php
These files expose sensitive application logic and credentials, including the bcrypt password hash for administrator accounts.
This vulnerability can also potentially lead to Remote Code Execution through log poisoning or other file inclusion techniques.
Proof of Concept
Request: http://localhost:8000/?page=php://filter/convert.base64-encode/resource=DBConnection
Result: The contents of DBConnection.php are returned encoded in base64 and rendered in the browser.
|
|---|
| Fonte | ⚠️ https://www.sourcecodester.com/php/16447/resort-reservation-system-php-and-sqlite3-source-code-free-download.html |
|---|
| Utilizador | Antony Esthak Twinson (UID 96471) |
|---|
| Submissão | 27/03/2026 15h11 (há 6 meses) |
|---|
| Moderação | 08/04/2026 21h13 (12 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 236234 [SourceCodester Resort Reservation System 1.0 index.php page Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|