Executive brief
Atals-Livre is an e-commerce web application for book sales and rentals. It contains a SQL injection vulnerability in its deletion helper function that allows unauthenticated attackers to manipulate database queries by passing malicious input via GET parameters, potentially leading to unauthorized data deletion or extraction.
Technical details
Atals-Livre contains a SQL injection vulnerability in the supp() deletion helper function. The vulnerability arises from unsanitized user input passed through GET parameters, allowing attackers to inject arbitrary SQL syntax. The attack vector is network-based and requires no authentication or user interaction. Successful exploitation enables attackers to perform unauthorized database operations including data extraction and deletion. The vulnerability was disclosed on July 31, 2026, and patches or mitigations should be verified with the vendor.
Affected products
- Maxime Amini Atals-Livre <UNKNOWN>
Timeline
- 2026-08-04: disclosed
- 2026-07-31: advisory: CVE disclosure and proof-of-concept published