Executive brief
itsourcecode Library Management System is a free web application for managing library operations including book catalogs, staff, and student records. The application contains a critical SQL injection vulnerability in multiple files where user input is directly concatenated into database queries without sanitization. An attacker can exploit this to extract, modify, or delete sensitive library data remotely without authentication.
Technical details
The vulnerability is a classic SQL injection (CWE-89) caused by direct concatenation of unsanitized GET parameters into SQL queries. In editbooks.php and related files, the $_GET['id'] parameter is directly embedded into SELECT statements (e.g., "SELECT * FROM books WHERE book_id = $id") without parameterization or input validation. The attack is remotely exploitable over the network with no authentication required. An attacker can inject SQL metacharacters via the id parameter to execute arbitrary queries, enabling data exfiltration via UNION-based injection, record modification, or deletion across multiple database tables. The fix requires casting the id parameter to an integer or implementing prepared statements with parameterized queries.
Affected products
- itsourcecode Library Management System 1.0
Timeline
- 2026-07-11: disclosed: Vulnerability reported via GitHub issue #89
- 2026-08-24: advisory: CVE-2026-78200 published on NVD