Attack Chain

1. The attacker identifies a page within the SourceCodester Leave Application System 1.0 that uses the page parameter to include files.
2. The attacker crafts a malicious URL containing the page parameter, injecting a path to a local file (e.g., ../../../../etc/passwd) or a remote file via a URL.
3. The vulnerable application processes the attacker-supplied page parameter without proper sanitization or validation.
4. The application attempts to include the file specified by the attacker’s malicious URL.
5. If the file is successfully included, the attacker can read sensitive information (e.g., /etc/passwd, database configuration files).
6. If the attacker can include a PHP file (e.g., via a log poisoning attack), they can achieve remote code execution on the server.
7. The attacker executes arbitrary commands on the server with the privileges of the web server user.
8. The attacker can then pivot to other systems, install malware, or exfiltrate sensitive data.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, such as configuration files, source code, and user credentials. Remote code execution is possible if the attacker can include a PHP file, potentially leading to complete system compromise. This could impact all users of the Leave Application System, potentially exposing employee data.

Recommendation

• Apply available patches or upgrade to a secure version of SourceCodester Leave Application System to remediate CVE-2026-5210.
• Deploy the provided Sigma rule to detect attempts to exploit the file inclusion vulnerability by monitoring for suspicious page parameter values in web server logs.
• Implement strict input validation and sanitization for all user-supplied input, especially parameters used for file inclusion.
• Restrict file system access for the web server user to only the necessary directories to prevent unauthorized file access.
• Monitor web server logs for access to sensitive files, such as /etc/passwd, database configuration files, and application source code.
• Block the reported malicious URL https://medium.com/@hemantrajbhati5555/local-file-inclusion-lfi-in-leave-application-system-php-sqlite3-4e095bb7ee40 at the network perimeter.