A SQL injection vulnerability in PMB 5.6 allows authenticated attackers to execute arbitrary database commands, posing a significant risk to data integrity and confidentiality.

The application fails to properly sanitize the logid parameter within the /admin/sauvegarde/download.php script. This flaw allows an authenticated attacker to inject and execute arbitrary SQL commands against the underlying MySQL database.

Successful exploitation of this vulnerability allows an attacker to interact directly with the application database, potentially leading to unauthorized data exfiltration, modification, or destruction. Given the CVSS score of 7.1, this represents a high-severity risk that could compromise the entire Integrated Library Management System, resulting in significant operational disruption and loss of sensitive records.

Immediate Action: Upgrade to the latest version of PMB to ensure the SQL injection vulnerability is patched, as version 5.6 and earlier are confirmed vulnerable.

Proactive Monitoring: Monitor web server access logs for requests directed at /admin/sauvegarde/download.php that contain unexpected characters or SQL syntax in the logid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Public Exploit Available: Yes — a public proof-of-concept is documented in the Exploit-DB entry 48356.

Organizations utilizing PMB must prioritize patching to remediate this SQL injection flaw. Because the vulnerability is reachable by authenticated users, it is critical to enforce the principle of least privilege for all administrative accounts to limit the potential blast radius of a compromised session while the update is being prepared and deployed.