Which versions of PHP are affected by CVE-2026-4624?

A critical SQL injection vulnerability in SourceCodester Online Library Management System 1.0 allows unauthenticated attackers to compromise database integrity and steal sensitive data without…

Is there a public PoC exploit available for CVE-2026-4624?

Yes, a public proof-of-concept exploit is available for CVE-2026-4624. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4624?

Within 24 hours: Inventory all systems running SourceCodester Online Library Management System 1.0 and assess whether they process sensitive data; isolate affected systems from production networks if possible and enable detailed logging on database connections. Within 7 days: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns on the /home.php searchField parameter; restrict network access to the application to authorized users only via IP whitelisting or VPN; consider disabling the search functionality if operationally feasible. Within 30 days: Evaluate migration to an alternative, actively maintained library management solution; maintain compensating controls until vendor patch availability is confirmed or system is decommissioned.

PHP CVE-2026-4624

Q: What is the CVSS score of CVE-2026-4624?

CVE-2026-4624 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14698 MEDIUM

SQL Injection (CWE-89)

2026-03-24 VulDB

GHSA-68f7-rw23-22jh

PHP SQLi Online Library Management System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 02:45 euvd

EUVD-2026-14698

Analysis Generated

Mar 24, 2026 - 02:45 vuln.today

CVE Published

Mar 24, 2026 - 02:14 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchField results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Online Library Management System 1.0 allows unauthenticated remote attackers to manipulate the searchField parameter in /home.php, enabling data exfiltration, modification, and potential service disruption. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

This vulnerability affects the Online Library Management System version 1.0 developed by SourceCodester, identified by CPE cpe:2.3:a:sourcecodester:online_library_management_system:*:*:*:*:*:*:*:*. The flaw is classified as CWE-89 (SQL Injection), a code injection vulnerability that occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. The vulnerable component is the Parameter Handler in /home.php, specifically the searchField argument, which is a PHP-based implementation. SQL injection allows attackers to manipulate database queries by injecting malicious SQL code through user-controllable input fields, breaking out of the intended query logic to execute arbitrary database commands.

RemediationAI

No official patch from SourceCodester has been identified in the available references as of this analysis (indicated by CVSS RL:X). Organizations running this software should immediately implement workarounds including: deploy a Web Application Firewall (WAF) with SQL injection signatures to filter malicious input to the searchField parameter in /home.php, implement strict input validation and parameterized queries at the application layer if source code modification is possible, restrict network access to the application to trusted IP ranges only, and monitor database logs for suspicious query patterns. Given the absence of vendor support, organizations should consider migrating to a supported and actively maintained library management system. For technical details on the exploit vector, consult the proof-of-concept at https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_6.md and VulDB advisories at https://vuldb.com/?id.352492 to understand attack patterns for defensive rule creation.