Library Management System CVE-2025-12237

No special conditions required - remote unauthenticated exploitation against default configurations of Advanced Library Management System 1.0. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N: the vulnerable /index.php endpoint with the keywords parameter is the application's primary interface and is accessible to all visitors without authentication. The only prerequisite is network reachability to the web server hosting the application. Limiting factors: the product has an extremely narrow deployment footprint (niche PHP library management script, unlikely in enterprise environments), and the low impact ceiling (VC:L/VI:L/VA:L) means the attacker achieves partial rather than full database access. No specific non-default configuration or feature flag is required to trigger the vulnerability.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the worst-case accessibility profile: fully network-exposed, no authentication, no complexity, no user interaction required. However, all impact metrics are rated Low (VC:L/VI:L/VA:L), with no subsequent-system impact (SC:N/SI:N/SA:N), which constrains the ceiling of actual damage - this suggests partial rather than full database compromise is the expected outcome. The E:P exploit maturity modifier in the provided CVSS 4.0 vector reflects the publicly available PoC. Despite this, the EPSS score of 0.03% (9th percentile) is extremely low, indicating negligible observed exploitation activity across the broader threat landscape. There is no CISA KEV listing. The tension between the accessible attack profile and the low EPSS is best explained by the obscure, niche nature of the product - attackers are not actively mass-scanning for this target. For any organization that does run this software in a publicly accessible configuration, however, the unauthenticated remote vector with a public PoC represents a real, actionable risk.

An unauthenticated attacker sends a crafted HTTP request to the publicly accessible /index.php endpoint with a SQL payload embedded in the keywords parameter - for example, appending a UNION-based injection string. The PHP application passes the unsanitized value directly into a database query, returning results that include data from arbitrary tables. A public PoC demonstrating this technique is available at https://github.com/juzidddd/Projectworlds-ALMS-SQLi-Vulnerability-Disclosure/issues/1.