Submit #1018605: oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Inclusion

The affected component is `index.php`, the application entry point. The value of the `page` GET parameter is concatenated with `.php` and passed directly to `include`:

```php
<?php $page = isset($_GET['page']) ? $_GET['page'] :'home'; ?>
<?php include $page.'.php' ?>
```

The login check above only issues a `header('location:login.php')` redirect without terminating execution, so the inclusion runs unauthenticated. An attacker can use PHP stream wrappers to read arbitrary local files, e.g. `?page=php://filter/convert.base64-encode/resource=db_connect` returns the base64-encoded source of `db_connect.php`, and directory traversal selects any other `.php` file inside or outside the web root. Combined with the unrestricted upload of PHP files into `assets/uploads/`, the same parameter executes attacker code remotely.

• Source: ⚠️ https://github.com/oretnom23/file-management-system-php/issues/1
• User: Zeming Hu (UID 101971)
• Submission: 10/07/2026 16:09 (16 days ago)
• Moderation: 10/21/2026 08:55 (14 days later)
• Status: Accepted
• VulDB entry: 424685 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 index.php include page file inclusion]
• Points: 20