An unauthenticated SQL injection vulnerability in Wecodex Library CMS 1.0 allows remote attackers to bypass authentication and potentially compromise the underlying database.

The application is vulnerable to boolean-based blind SQL injection in the username parameter of the admin login endpoint. An unauthenticated attacker can send specially crafted POST requests to manipulate database queries and achieve unauthorized access.

The vulnerability carries a CVSS score of 8.2, reflecting a high risk of unauthorized access to administrative functions. Successful exploitation allows an attacker to bypass authentication, which could lead to full administrative control of the application, unauthorized data exfiltration, or modification of library records, causing significant reputational and operational damage.

Immediate Action: As no official patch is currently available from the vendor, users should restrict access to the administrative login endpoint using network-level controls or IP allowlisting.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to the index.php file containing SQL syntax characters like quotes, semicolons, or RLIKE keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit-DB entry 44728.

Given the high severity and the availability of a public proof-of-concept, this vulnerability poses a credible threat to any deployment of Wecodex Library CMS 1.0. Organizations should prioritize isolating the affected administrative interface from public access until a secure version is released or the application is decommissioned.