A critical SQL injection vulnerability in Senayan Library Management System 9.0.0 allows unauthenticated attackers to execute arbitrary database queries and potentially compromise system data.

The application fails to properly sanitize the class parameter, which is processed in a manual insertion point. This SQL injection flaw allows an unauthenticated attacker to inject malicious SQL queries into the backend database.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, leading to potential data exfiltration or corruption. With a CVSS score of 8.2, the risk is classified as High, as it provides an attacker with the ability to manipulate database operations without requiring any prior authentication. This poses a significant threat to the confidentiality and integrity of library records and user information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected application endpoints or disable the vulnerable module if it is not essential for operations.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically looking for SQL keywords or unusual characters within the class parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the class parameter.

Public Exploit Available: Yes, a proof of concept is published via the Exploit Database (EDB-ID 51161).

Given the severity of this SQL injection flaw and the availability of public exploit material, organizations must prioritize mitigating this risk immediately. If an official vendor update remains unavailable, isolating the application from public access is the most effective way to prevent exploitation until a formal patch is released.