The vulnerability is a boolean‑based blind SQL injection flaw located in the username field of the admin login. Unauthenticated attackers can craft POST requests that manipulate the database query used for authentication, causing the system to accept the login without valid credentials. This results in full administrative privileges, allowing the attacker to read, modify, or delete library records.

The flaw impacts Wecodex’s Library CMS 1.0 and the identical Kaasoft distribution, both sharing the same code base. No other vendors or product versions are listed as affected.

With a CVSS score of 8.8 the weakness is rated high severity, threatening confidentiality and integrity of the data. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not present in CISA’s KEV catalog. Attackers can exploit the flaw over the network by sending crafted HTTP POST requests to the admin login endpoint; no legitimate credentials or privileged access are required.