The Basic Library System version 1.0 contains a SQL Injection flaw in the /librarysystem/load_book.php endpoint. The vulnerability allows an attacker to manipulate the SQL query executed against the database, potentially retrieving or modifying sensitive data. This weakness is classified as CWE‑89 and does not require elevated privileges to exploit. Based on the description, it is inferred that an attacker could craft input directly into the endpoint URL or form fields, resulting in unauthorized database access.

The affected product is the Basic Library System authored by Razormist, version 1.0. No other vendors or versions are identified in the available data.

The CVSS base score of 2.7 places the issue in the low to moderate severity range, and an EPSS score of less than 1 % indicates that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector involves sending crafted input to the load_book.php page, and exploitation is possible as long as the input is not properly sanitized or parameterized. Based on the description, it is inferred that the flaw remains exploitable in the current configuration.