The Library Automation System contains an improper control of code generation flaw that allows attackers to inject and execute arbitrary PHP code via the system’s input processing. Exploiting this flaw can give the attacker full remote code execution on the server. The vulnerability is categorized as CWE‑94, a code‑injection weakness.

Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System versions 19.5 through 22.0 are vulnerable. Version 22.1 and later contain the fix.

The CVSS score of 8.8 classifies the flaw as high severity. Although its EPSS score is not available, the absence of a currently available public exploit and its inclusion in the high‑severity band still make it a serious attack vector. The issue is not listed in the CISA KEV catalog. Attackers could reach the vulnerable input endpoints over the network, implying a remote attack vector.