An SQL injection flaw (CWE‑74, CWE‑89) exists in the book.php file of itsourcecode Online Book Store, where the bookisbn query parameter is incorporated into a database statement without proper sanitization. This flaw allows a remote attacker to inject arbitrary SQL, potentially enabling them to read, modify or delete book records and other sensitive data.

The vulnerability affects the Online Book Store application released by itsourcecode, version 1.0. Users running this version are susceptible if the application hosts book.php on a publicly accessible web server.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS score provides limited insight into exploitation likelihood. Because the attack can be performed over the network and the flaw is publicly disclosed, there is a tangible risk of data compromise. The issue is not currently listed in the CISA KEV catalog, but organizations should still consider it a priority for patching or mitigation.