Atals Livre
Monthly
SQL injection in Atals-Livre exposes its database to manipulation by authenticated high-privileged users through an unsanitized GET parameter in the supp() deletion helper function. Exploitation enables unauthorized SQL operations including arbitrary record deletion and data extraction against any database instance backing the application. A public Gist writeup exists that appears to document reproduction steps; no CISA KEV listing confirms active exploitation at time of analysis.
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
SQL injection in Atals-Livre exposes its database to manipulation by authenticated high-privileged users through an unsanitized GET parameter in the supp() deletion helper function. Exploitation enables unauthorized SQL operations including arbitrary record deletion and data extraction against any database instance backing the application. A public Gist writeup exists that appears to document reproduction steps; no CISA KEV listing confirms active exploitation at time of analysis.
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.