A file inclusion vulnerability in SourceCodester Leave Application System 1.0 poses a significant risk of unauthorized file access and remote exploitation.

The application is affected by a file inclusion flaw (CWE-73) that can be triggered by manipulating the page argument. The CVSS vector indicates that this vulnerability is exploitable by an unauthenticated attacker over the network without requiring user interaction.

Successful exploitation of this flaw allows an attacker to read arbitrary files from the server, which may lead to the exposure of configuration details, sensitive credentials, or internal source code. Given the CVSS score of 7.3, this is a high-severity issue that could facilitate further system compromise or data exfiltration, directly impacting the confidentiality and integrity of the hosting environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application via network-level controls or take the system offline if it is exposed to the public internet.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unusual file path inclusions targeting the page parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests that attempt to pass file paths or traversal sequences through the page argument.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the referenced security report.

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability should be treated with high priority. Organizations using SourceCodester Leave Application System 1.0 must implement strict input validation and access controls immediately to mitigate the risk of unauthorized file access until an official vendor patch is released.