The flaw is a classic SQL injection in the load_admin.php endpoint of Sourcecodester Basic Library System v1.0. Because user input is incorporated into database queries without proper sanitization or parameterization, an attacker can inject arbitrary SQL statements. This could lead to unauthorized disclosure of sensitive data, alteration of library records, or even destruction of the underlying database. The vulnerability directly affects the confidentiality and integrity of the system, and may compromise availability if destructive queries are executed.

This vulnerability impacts the open‑source Sourcecodester Basic Library System at version 1.0. No vendor or product name is listed beyond the project itself, and the affected component is the load_admin.php file inside the /librarysystem directory. Users running this exact version in any environment are at risk, regardless of host configuration.

The risk is considered moderate to high because the exploit requires only Web access to the vulnerable endpoint, making it publicly exploitable. No exploit probability score is available and the vulnerability is not listed in the CISA KEV catalog, but the nature of SQL injection is well understood and provides a clear attack path. Attackers who can send malicious input to the endpoint can gain full database control, making this a significant threat for any deployment of the affected version.