CVE-2026-15537: SourceCodester Online Book Store System SQL injection in admin login

Executive brief

A security vulnerability exists in the SourceCodester Online Book Store System, a web application used for managing book sales. An attacker can exploit the login page to bypass security controls or access sensitive database information. This could lead to unauthorized access to the administrative dashboard and potential theft of customer or store data.

Technical details

A SQL injection vulnerability exists in SourceCodester Online Book Store System 1.0 within the 'admin/login.php' file. The application fails to properly sanitize the 'Username' input argument before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL commands to the login form, potentially leading to authentication bypass or unauthorized data extraction. A public exploit has been released for this vulnerability.

Affected products

• SourceCodester Online Book Store System 1.0

Timeline

• 2026-07-13: advisory: CVE-2026-15537 published by NVD/VulDB

References

• https://medium.com/@gauravkumar67482/sql-injection-leading-to-authentication-bypass-43b773da1967
• https://vuldb.com/cve/CVE-2026-15537
• https://vuldb.com/submit/855010
• https://vuldb.com/vuln/377887
• https://vuldb.com/vuln/377887/cti
• https://www.sourcecodester.com/