Which versions of Atals-Livre are affected by CVE-2026-69704?

Atals-Livre is vulnerable to SQL injection (CVE-2026-69704) that allows authenticated administrators to delete records and extract data from any database instance, directly threatening organizational…

How to fix or mitigate CVE-2026-69704?

Within 24 hours, restrict access to the supp() deletion function to only essential personnel, review audit logs for suspicious database modifications, and notify security leadership of the vulnerability. Within 7 days, deploy Web Application Firewall (WAF) rules blocking SQL injection patterns in GET parameters, contact Atals-Livre for patch timeline and interim workarounds, and complete an access control audit of all users with administrative privileges. Within 30 days, evaluate architectural alternatives to eliminate the vulnerable function, conduct forensic analysis of database changes since discovery, and perform incident response tabletop exercises to prepare for potential exploitation.

Atals-Livre CVE-2026-69704

Q: What is the CVSS score of CVE-2026-69704?

CVE-2026-69704 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52868 HIGH

SQL Injection (CWE-89)

2026-08-04 VulnCheck

GHSA-w8hf-r35f-2h3j

SQLi Atals Livre

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network vector via GET parameter confirmed; PR:H per CVSS 4.0 source vector; C rated High because the description explicitly claims data extraction is achievable, contradicting the VC:N in the provided CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 19:21 vuln.today

CVE Published

Aug 04, 2026 - 18:47 cve.org

HIGH 7.0

DescriptionCVE.org

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized database operations including data deletion and extraction.

AnalysisAI

SQL injection in Atals-Livre exposes its database to manipulation by authenticated high-privileged users through an unsanitized GET parameter in the supp() deletion helper function. Exploitation enables unauthorized SQL operations including arbitrary record deletion and data extraction against any database instance backing the application. A public Gist writeup exists that appears to document reproduction steps; no CISA KEV listing confirms active exploitation at time of analysis.

Technical ContextAI

Atals-Livre (CPE: cpe:2.3:a:maximeamini:atals-livre:*:*:*:*:*:*:*:*) is a small open-source PHP web application maintained by maximeAmini on GitHub. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical SQL injection weakness class. The supp() function, designed as a deletion helper, accepts user-supplied input via an HTTP GET parameter and interpolates it directly into a SQL query without using parameterized statements, prepared queries, or any sanitization layer. This allows an attacker to append or alter SQL syntax - redirecting, expanding, or subverting the intended query's scope and effect against the underlying database engine.

RemediationAI

No vendor-released patch has been identified at time of analysis; the upstream GitHub repository at https://github.com/maximeAmini/Atals-Livre should be monitored for commits that address the supp() function's parameter handling. The definitive code-level fix is to replace string-concatenated SQL construction in supp() with parameterized prepared statements or a database abstraction layer that enforces query parameterization - this eliminates the injection vector without application-side effects. As an immediate compensating control, enforce strict authentication and authorization on the supp() deletion endpoint to ensure only legitimate high-privilege administrators can invoke it, reducing the exposed population. If the application is internet-facing, deploying a Web Application Firewall with SQL injection detection rules provides an additional detection and blocking layer, though WAF bypass techniques exist and this is not a substitute for source-level remediation. See the VulnCheck advisory at https://www.vulncheck.com/advisories/atals-livre-sql-injection-via-unsanitized-get-parameter-in-supp for further context.