| 标题 | SourceCodester Resort Reservation System (PHP + SQLite3) 1.0 Local File Inclusion |
|---|
| 描述 | Local File Inclusion (LFI) via page Parameter
Severity: Critical
CWE: CWE-98 — Improper Control of Filename for Include/Require Statement
Authentication: Required (any authenticated user)
Affected File: index.php
Relevant Code
$page = $_GET['page'] ?? 'home';
include($page . ".php");
Description
The application directly passes the user-controlled page parameter into the include() function without validation or allowlisting.
An attacker can abuse PHP stream wrappers such as php://filter to read sensitive files on the server. Using the base64-encoding filter bypasses the enforced .php extension and allows disclosure of application source code.
Impact
An authenticated attacker can read arbitrary PHP source files including:
• DBConnection.php
• Master.php
• auth.php
• login.php
These files expose sensitive application logic and credentials, including the bcrypt password hash for administrator accounts.
This vulnerability can also potentially lead to Remote Code Execution through log poisoning or other file inclusion techniques.
Proof of Concept
Request: http://localhost:8000/?page=php://filter/convert.base64-encode/resource=DBConnection
Result: The contents of DBConnection.php are returned encoded in base64 and rendered in the browser.
|
|---|
| 来源 | ⚠️ https://www.sourcecodester.com/php/16447/resort-reservation-system-php-and-sqlite3-source-code-free-download.html |
|---|
| 用户 | Antony Esthak Twinson (UID 96471) |
|---|
| 提交 | 2026-03-27 15時11分 (6 月前) |
|---|
| 管理 | 2026-04-08 21時13分 (12 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 236234 [SourceCodester Resort Reservation System 1.0 index.php page 权限提升] |
|---|
| 积分 | 0 |
|---|