A remote attacker can manipulate the 'page' query parameter in the /admin/index.php script of the SourceCodester Online Book Store System. The vulnerability arises from improper control of the filename passed to a PHP include/require statement, enabling the attacker to request arbitrary local files. When exploited, this results in source code disclosure and potentially sensitive configuration files becoming accessible. The confidentiality of the system is at risk, and the unauthorized retrieval of credentials or application logic may serve as a stepping stone for further malicious activity. The weakness corresponds to directory traversal and improper inclusion controls, classed as CWE-73 and CWE-98.

The flaw exists in the SourceCodester Online Book Store System version 1.0, specifically within the administrative interface located at /admin/index.php. No other vendors, products, or versions are listed as affected. Administrators should confirm that their installation matches this version before applying mitigations.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation, yet the flaw is publicly documented and can be leveraged remotely via a crafted URL. The vulnerability is not listed in the CISA KEV catalog. Attackers need only supply a malicious 'page' parameter value to trigger the Local File Inclusion, after which sensitive files may be read. The primary risk is to confidentiality; the impact on integrity or availability is limited unless the attacker uses the retrieved information to launch subsequent attacks.