Executive brief
Sourcecodester Basic Library System is a web-based application used for managing library records and administrative tasks. A security vulnerability in the administrative interface allows an authorized user with high-level privileges to perform unauthorized database queries. While this requires an existing administrative account, it could allow a malicious insider or a compromised admin account to view sensitive information stored in the database beyond their intended access level.
Technical details
A SQL injection vulnerability exists in Sourcecodester Basic Library System v1.0 within the 'admin_id' parameter of the /librarysystem/load_admin.php component. The application fails to properly sanitize user-supplied input before using it in a SQL query, allowing for Union-based SQL injection. An attacker with high-level administrative privileges can exploit this via a specially crafted GET request to extract sensitive information from the database, such as the database name or other table data. The vulnerability was demonstrated using a payload that leverages a UNION SELECT statement to leak database metadata.
Affected products
- Sourcecodester Basic Library System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory