The Basic Library System version 1.0 includes a SQL injection flaw in the file load_book.php. The flaw allows an attacker to inject arbitrary SQL through user-controlled input, potentially leading to unauthorized data disclosure, modification, or destruction. The weakness resides in improper input handling and dynamic query construction, identified as a typical SQL injection weakness.

The vulnerability affects Sourcecodester Basic Library System v1.0, specifically the web endpoint /librarysystem/load_book.php. Users deploying this version of the system are directly exposed to the flaw.

Although no CVSS or EPSS score is publicly available, the nature of SQL injection indicates a high potential impact. The likely attack vector is a remote HTTP request to the load_book.php script with crafted parameters. Without additional safeguards, an attacker could gain full read/write access to the underlying database. The vulnerability is not listed in KEV, so the exploit probability is currently uncertain, but the inherent risk warrants immediate attention.