Executive brief
Sourcecodester Basic Library System is a web application used for managing library records and student information. A security flaw allows an authorized user with high-level privileges to perform unauthorized database queries. This could lead to the exposure of sensitive internal database information, though it requires an existing administrative account to execute.
Technical details
A SQL injection vulnerability exists in Sourcecodester Basic Library System v1.0 within the 'student_id' parameter of the /librarysystem/load_student.php endpoint. The application fails to properly sanitize user-supplied input before using it in a database query, allowing for Union-based SQL injection. An attacker with high privileges (such as an administrator) can exploit this to leak database metadata, such as the database name, or other sensitive information. The vulnerability was identified in environments running PHP 8.1 via XAMPP. No official patch has been reported.
Affected products
- Sourcecodester Basic Library System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory