The vulnerability in SourceCodester Online Book Store System 1.0 arises from insufficient validation of the 'page' parameter in the /admin/index.php file, which is used in an include or require statement. This improper control of the filename can be exploited remotely to include arbitrary files, potentially leading to code execution or information disclosure. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official fix or patch has been published as of the data provided.

An attacker can remotely manipulate the 'page' parameter to control the filename used in PHP include/require statements, which may lead to arbitrary file inclusion. This can result in unauthorized code execution or disclosure of sensitive information within the affected system. The impact is rated medium severity with limited confidentiality impact and no integrity or availability impact explicitly stated.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the administrative interface and implementing web application firewall rules to block malicious input targeting the 'page' parameter may help reduce exposure.