The vulnerability CVE-2026-15540 affects SourceCodester Online Book Store System 1.0. It arises from insufficient validation or control over the 'page' parameter in the /admin/index.php file's include or require statement. An attacker can remotely manipulate this parameter to control the filename included by the PHP program, which may lead to unauthorized file inclusion. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or patch has been disclosed, and the exploit code is publicly available.

Successful exploitation allows a remote attacker to influence the file inclusion process in the administrative interface, potentially leading to unauthorized code execution or disclosure of sensitive files. This can compromise the integrity and confidentiality of the affected system. However, the CVSS vector indicates low complexity and no required privileges or user interaction, making exploitation feasible in vulnerable environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative interface to trusted users only and consider implementing input validation or filtering on the 'page' parameter to prevent malicious input.