CVE-2026-78200: SQL Injection in itsourcecode Library Management System

The itsourcecode Library Management System version 1.0 contains a SQL injection vulnerability in an unspecified function of the editbooks.php file. By manipulating the ID parameter, an attacker can perform SQL injection remotely without requiring user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code is publicly available, though no active exploitation has been confirmed.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database remotely. This can lead to unauthorized data access, modification, or deletion depending on the database permissions. The vulnerability does not require user interaction or elevated privileges, increasing its risk. However, the overall impact is rated medium due to limited details on the scope of the injection and the absence of known active exploitation.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the editbooks.php file and the ID parameter may reduce risk. Avoid exposing the vulnerable application to untrusted networks if possible.