SQL Injection Vulnerability in Code-Projects Library System

CVE-2024-1826

Summary

A significant vulnerability has been identified in the Code-Projects Library System 1.0 that allows for SQL injection attacks through the manipulation of username and password arguments in the 'login.php' file located in the Source/librarian/user/student directory. This security flaw enables attackers to execute arbitrary SQL queries, which could lead to unauthorized access to sensitive data. The vulnerability can be exploited remotely, meaning that malicious actors do not need physical access to the system to initiate an attack. The exploit has already been publicly disclosed, raising concerns about the potential risk to user data integrity and confidentiality.

References