Online Library Management System CVE-2026-4624

Remote unauthenticated attacker can exploit SQL injection in SourceCodester Online Library Management System 1.0 via the searchField parameter in /home.php. No authentication, user interaction, or special configuration required. Default installations vulnerable.

The CVSS v3.1 score of 7.3 (HIGH) reflects a serious vulnerability with Network attack vector (AV:N), Low complexity (AC:L), and No privileges required (PR:N), making it easily exploitable by remote unauthenticated attackers. The vulnerability enables Low impact to Confidentiality, Integrity, and Availability (C:L/I:L/A:L), though SQL injection typically allows full database compromise in practice. The Exploit maturity is Proof-of-concept (E:P) with a public GitHub POC available, significantly elevating real-world risk. The absence of remediation level information (RL:X) suggests no official patch has been released. While no EPSS score or KEV status is provided in the data, the combination of low attack complexity, network accessibility, public exploit code, and the widespread use of similar SourceCodester applications in educational and small business contexts makes this a high-priority vulnerability for organizations running this specific software. The real-world risk is elevated beyond the CVSS score due to exploit availability and the typical deployment of library management systems with public-facing search functionality.

An unauthenticated attacker visits the library's public website and uses the search functionality on the /home.php page. By injecting SQL code into the searchField parameter (for example, using a UNION-based or Boolean-based blind SQL injection payload), the attacker bypasses authentication, extracts the entire user database including administrator credentials, modifies book availability records, or drops critical tables causing service disruption. Given the low attack complexity and public availability of a working proof-of-concept exploit on GitHub, script kiddies and automated scanning tools can easily identify and compromise vulnerable installations without requiring specialized knowledge.