Technical impact
The vulnerability lies in an unprotected function of the editbooks.php script within the Library Management System. An attacker can manipulate the ID argument to inject arbitrary SQL statements, giving the attacker the ability to read, modify, or delete data stored in the back‑end database. This is a classic SQL injection flaw (CWE‑74 and CWE‑89) that has the potential to compromise confidentiality, integrity, or availability of the application’s data.
Affected Systems
The flaw affects itsourcecode Library Management System version 1.0, which runs on a web server exposed over the internet. The vulnerable code is reachable through the editbooks.php endpoint, and the product is marketed under the itsourcecode brand.
Risk and Exploitability
With a CVSS score of 5.3 the vulnerability is classified as moderate. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. Attackers can execute the flaw remotely by sending a crafted request to the editbooks.php endpoint that includes a malicious ID payload; because the parameter is not validated, the injection succeeds without authentication. The exploitation is simplest for anyone who can reach the web interface from the network, potentially leading to unauthorized data disclosure or control over the database.
