CVE-2026-114039: Advanced Library Management System SQLI

CVE-2026-114039 is a SQL injection vulnerability in projectworlds Advanced Library Management System 1.0 affecting the report_search.php file. Attackers can exploit this remotely to manipulate database queries. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-114039 Overview

CVE-2026-114039 is a SQL injection vulnerability in projectworlds Advanced Library Management System 1.0. The flaw resides in the report_search.php script, where the dateto and datefrom parameters are passed unsanitized to the mysqli_query function. Remote attackers with low-privileged access can manipulate these parameters to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the probability of opportunistic abuse against exposed deployments. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated remote attackers can inject SQL statements through the dateto and datefrom parameters of report_search.php, exposing library records and backend database contents.

Affected Products

projectworlds Advanced Library Management System 1.0
report_search.php component invoking mysqli_query
Deployments exposing the dateto and datefrom request parameters

Discovery Timeline

2026-10-21 - CVE-2026-114039 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-114039

Vulnerability Analysis

The vulnerability exists in the reporting workflow of projectworlds Advanced Library Management System 1.0. The report_search.php script accepts date-range inputs through the dateto and datefrom request parameters. These values flow directly into a mysqli_query call without parameterization or sanitization. An attacker who controls the parameter contents controls the resulting SQL statement. Successful exploitation allows reading or modifying rows the application database user can access, including borrower records, catalog entries, and credential tables.

Root Cause

The root cause is improper neutralization of special elements in a SQL query, consistent with [CWE-74]. The application concatenates user-supplied dateto and datefrom strings into a SQL statement rather than binding them as parameters. No input validation or type checking is performed on the date values before they reach the database layer.

Attack Vector

The attack vector is network-based and requires low-privileged authentication to reach the report search endpoint. An attacker submits a crafted HTTP request to report_search.php with SQL metacharacters embedded in the dateto or datefrom parameter. The injected payload executes within the database context of the application. Public proof-of-concept details are referenced in the VulDB entry for CVE-2026-114039 and the GitHub PHP Project Repository.

Detection Methods for CVE-2026-114039

Indicators of Compromise

HTTP requests to report_search.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the dateto or datefrom parameters.
Database error messages returned to clients referencing mysqli or malformed SQL syntax from the reporting workflow.
Unusual outbound responses from the web application containing dumped table rows unrelated to date-range reports.

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the dateto and datefrom parameters on the report_search.php endpoint.
Review database query logs for unexpected UNION, INFORMATION_SCHEMA, or stacked queries originating from the library application user.
Correlate authenticated session identifiers with anomalous report-search request volumes or payload sizes.

Monitoring Recommendations

Ingest web server access logs and MySQL general query logs into a centralized analytics platform for parameter-level inspection.
Alert on repeated 500-series responses from report_search.php, which often indicate SQL injection probing.
Monitor for new user accounts, altered permissions, or unexpected schema reads following access to the reporting endpoint.

How to Mitigate CVE-2026-114039

Immediate Actions Required

Restrict access to report_search.php to trusted administrative networks until a code-level fix is deployed.
Apply a web application firewall rule blocking SQL metacharacters in the dateto and datefrom parameters.
Rotate database credentials used by the application if exploitation is suspected.
Audit the application database for unauthorized read access, modified rows, or new privileged accounts.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Review the GitHub PHP Project Repository and the VulDB Vulnerability Details for updates. Operators maintaining their own forks should refactor report_search.php to use prepared statements with bound parameters for dateto and datefrom.

Workarounds

Enforce server-side input validation that rejects any dateto or datefrom value not matching a strict date format such as YYYY-MM-DD.
Run the application database account with least privilege, removing FILE, CREATE USER, and GRANT permissions.
Disable or remove the reporting module if it is not required in the deployment.
Place the application behind an authenticated reverse proxy to limit exposure to unauthenticated reconnaissance.

bash

# Example WAF rule (ModSecurity) blocking SQLi in dateto/datefrom
SecRule ARGS:dateto|ARGS:datefrom "@rx (?i)(union(\s)+select|--|/\*|;|')" \
  "id:1140039,phase:2,deny,status:403,log,msg:'CVE-2026-114039 SQLi attempt in report_search.php'"