This vulnerability is a classic SQL injection flaw located in the Username parameter of admin/login.php. By inserting malicious SQL into that field, an attacker can alter the query that validates credentials, enabling unauthorized bypass of the admin login and full administrative control. The weakness is categorized as CWE‑89 (SQL Injection) and CWE‑74 (Path Manipulation). The resulting compromise allows an attacker to read, modify, or delete sensitive data, alter configuration, or disrupt service availability. The flaw can be triggered remotely by sending a crafted HTTP request to the vulnerable entry point. No specialized network conditions or privileged access are required; the attack can be executed over the public internet if the admin interface is exposed. Although the public exploit scripts have been released, the EPSS score of less than 1% indicates that current targeted attacks are uncommon, yet the risk remains moderate because the flaw grants full administrative rights once exploited. The vulnerability is not listed in the CISA KEV catalog, but the existence of publicly available exploitation code increases the likelihood of opportunistic attacks.

SourceCodester Online Book Store System version 1.0 is affected. The repository identifies the flaw in the admin login functionality; no other versions or components have been confirmed vulnerable.

The CVSS score of 6.9 reflects moderate severity with remote authentication bypass. Because the exploit is publicly available, any system exposing the admin interface can be targeted. The low EPSS score suggests the likelihood of attack is currently low, yet the impact of successful exploitation is high. The vulnerability is not in the CISA KEV catalog, meaning it has not yet been observed in known exploit campaigns. Attackers can reach the vulnerable point via standard HTTP requests, submit a malicious Username string, and immediately achieve administrative access.