A critical SQL injection vulnerability in code-projects Library System 1.0 allows unauthenticated remote attackers to compromise database integrity.

The application fails to properly sanitize user input in the Username parameter within the index.php file of the Login component, allowing for remote SQL injection. This vulnerability is exploitable by an unauthenticated attacker.

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the library management system, necessitating prompt intervention to prevent data breaches.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface or consider disabling the service until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in the Username field, such as SQL syntax characters or unexpected query structures.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical documentation provided at the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability poses a high risk to the application environment. Security teams must prioritize isolating the affected system from external networks and applying vendor-provided security updates as soon as they become available.