CVE-2026-114265: Library Management System SQL Injection

CVE-2026-114265 Overview

CVE-2026-114265 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System 1.0. The flaw resides in the mysqli_query call within the returned_book_search.php file, specifically in the Search Form component. An authenticated remote attacker can manipulate the datefrom and dateto parameters to inject arbitrary SQL statements. Public exploit details are available, lowering the barrier to abuse. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Attackers can inject SQL via the datefrom and dateto parameters, exposing or altering library database records remotely.

Affected Products

ProjectWorlds Advanced Library Management System 1.0
Component: Search Form (returned_book_search.php)
Vulnerable function: mysqli_query

Discovery Timeline

2026-10-21 - CVE-2026-114265 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-114265

Vulnerability Analysis

The vulnerability exists in returned_book_search.php, which processes user-supplied date range input through the Search Form. The datefrom and dateto HTTP parameters flow directly into a mysqli_query call without parameterization or sanitization. An attacker who can reach the search form can submit crafted values that break out of the intended SQL string context. Successful injection allows reading, modifying, or deleting records stored in the backing MySQL database.

The attack is executable over the network and requires only low-level authenticated access to the application. The impact spans confidentiality, integrity, and availability of library data, including borrower records and book inventory. Public references on VulDB confirm that a working exploit is already available, which raises the practical risk of opportunistic abuse against exposed installations.

Root Cause

The root cause is concatenation of untrusted input directly into a dynamic SQL statement. The datefrom and dateto request parameters are passed to mysqli_query without prepared statements, type casting, or input validation. This classifies the issue under [CWE-74] injection flaws and more specifically as SQL injection.

Attack Vector

An attacker interacts with the Search Form endpoint and supplies SQL metacharacters in the datefrom or dateto fields. The payload is interpolated into the SQL query, altering the original statement logic. No elevated privileges or user interaction beyond standard login access are required. See the VulDB entry for CVE-2026-114265 and the public project repository for technical context.

// No verified exploit code is reproduced here. Refer to the
// VulDB advisory for CVE-2026-114265 for public technical details.

Detection Methods for CVE-2026-114265

Indicators of Compromise

HTTP requests to returned_book_search.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences in datefrom or dateto parameters.
Unexpected MySQL errors or long-running queries originating from the library application's database user.
Anomalous outbound responses from the search endpoint containing database schema fragments or row counts inconsistent with the UI.

Detection Strategies

Deploy web application firewall rules to flag SQL injection patterns targeting datefrom and dateto parameters on the returned_book_search.php path.
Enable MySQL general or slow query logging and alert on malformed SELECT statements against the returned books table.
Correlate authentication logs with search form activity to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Monitor PHP error logs for mysqli_query warnings tied to the returned book search workflow.
Track request volume and payload length on the Search Form to detect automated injection tooling.
Alert on database schema reads such as queries against information_schema from the application's service account.

How to Mitigate CVE-2026-114265

Immediate Actions Required

Restrict network exposure of the Advanced Library Management System to trusted users while a fix is evaluated.
Disable or gate the returned_book_search.php endpoint behind additional authentication until the input handling is corrected.
Review database audit logs for prior abuse of the datefrom and dateto parameters.

Patch Information

No vendor patch is referenced in the published advisory for CVE-2026-114265. Operators should track the VulDB vulnerability record and the upstream project for remediation updates. In the interim, apply code-level fixes by rewriting the vulnerable query to use prepared statements with bound parameters and strict date validation.

Workarounds

Replace the dynamic mysqli_query call in returned_book_search.php with mysqli_prepare and bound parameters typed as dates.
Validate datefrom and dateto server-side against a strict YYYY-MM-DD pattern before query construction.
Apply least-privilege database permissions so the application account cannot read information_schema or modify unrelated tables.

bash

# Example PHP hardening pattern for the search query
# $stmt = $conn->prepare("SELECT * FROM returned_books WHERE return_date BETWEEN ? AND ?");
# $stmt->bind_param("ss", $datefrom, $dateto);
# $stmt->execute();