A crafted SQL injection vulnerability exists in the supp() deletion helper of Atals‑Livre. By passing unsanitized input through a GET parameter, an attacker can inject arbitrary SQL commands. The flaw allows the execution of unauthorized operations such as extracting sensitive data or deleting records, compromising confidentiality and integrity of the database. The weakness is a classic parameterized query problem, cataloged as CWE‑89.

The affected product is Atals‑Livre developed by maximeAmini. No specific version details were provided in the advisory, so all released builds of the application may be susceptible.

The common vulnerability scoring system assigns a CVSS score of 7, indicating high severity. The EPSS value is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to deliver a malformed GET request to the supp() endpoint, which is typically reachable over the network; thus the attack vector is likely public or within an untrusted network segment. Once the injection succeeds, an adversary can manipulate or extract data without additional privileges.