Online Book Store CVE-2026-116515

Exploitation targets the bookisbn argument of the /book.php endpoint in itsourcecode Online Book Store 1.0; the attacker must reach this page over the network and, per the CVSS PR:L metric, hold at least low-privilege access (authentication requirement is taken from the vector, not asserted by the description, which does not state the auth context). The limiting factors are: PR:L (not unauthenticated), partial-only technical impact (SSVC), and the extremely small deployment base of this product. The exact SQL trigger mechanism beyond manipulation of bookisbn is not described in the available sources, and no non-default configuration is stated as required.

This is a low-priority issue despite being a remotely reachable SQL injection. The signals align consistently toward low real-world risk rather than conflicting: the CVSS 4.0 base score is 2.1 (Low), with AV:N and AC:L indicating easy network reachability but PR:L requiring some authenticated/low-privilege access, and only partial impact across all three dimensions (VC:L/VI:L/VA:L, no subsequent-system impact). EPSS is 0.25% (16th percentile), very low, and the vuln.today decision label is 'monitor' - the lowest actionable tier. SSVC reinforces this: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. There is no CISA KEV listing, so no evidence of active exploitation. The one upgrading factor is that a public PoC reference exists (SSVC poc; E:P in the vector; description states the exploit was disclosed), but PoC availability is distinct from active exploitation and does not by itself elevate priority here. Note CWE-74 (generic injection) is broader than the described SQL injection (CWE-89 would be more precise) - a labeling imprecision, not a risk conflict. Net: a genuine but low-severity flaw in a very low-footprint product; monitor rather than expedite.

A low-privileged authenticated user (per PR:L) sends a crafted value in the bookisbn parameter to /book.php, injecting SQL that is concatenated into a backend query, allowing limited extraction or modification of database contents. A public PoC reference exists (GitHub issue), lowering the effort to reproduce, though it is not verified as working exploit code. The partial technical impact and low CVSS sub-metrics indicate constrained rather than full database compromise.