CVE-2026-114266: Advanced Library Management System SQLi

CVE-2026-114266 Overview

CVE-2026-114266 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System 1.0. The flaw resides in the mysqli_query function call within profile.php, where the admin_id parameter is passed to the database without proper sanitization. An attacker with low-level privileges can manipulate the parameter remotely to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the likelihood of opportunistic use against exposed deployments. The weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can read, modify, or delete library database records through crafted admin_id values submitted to profile.php.

Affected Products

ProjectWorlds Advanced Library Management System 1.0
profile.php component invoking mysqli_query
Deployments exposing the application over the network

Discovery Timeline

2026-10-21 - CVE-2026-114266 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114266

Vulnerability Analysis

The vulnerability exists in the profile.php script of ProjectWorlds Advanced Library Management System 1.0. The script concatenates the admin_id request parameter directly into a SQL statement before passing it to mysqli_query. Because the input is neither validated nor parameterized, attackers can break out of the intended query context and append arbitrary SQL fragments. The result is unauthorized access to data stored in the backing MySQL database, including potential modification or deletion of records. The attack requires low privileges and no user interaction, and it can be executed across the network. Additional context is available in the VulDB CVE Report and VulDB Vulnerability Details.

Root Cause

The root cause is improper neutralization of special elements in input used to construct a database query. The admin_id argument flows into mysqli_query without prepared statements, bound parameters, or type casting. Any character that terminates a string literal or statement is honored by the database engine.

Attack Vector

The attack vector is network-based. An authenticated user with low privileges issues a request to profile.php with a malicious admin_id value. The injected payload is interpreted as SQL by the backend, enabling data extraction through techniques such as UNION-based queries, boolean-based blind inference, or time-based blind inference. Public disclosure of the exploit lowers the barrier to reproduction. See the GitHub Project Repository for source code context.

// Example exploitation code (sanitized)
// No verified proof-of-concept code is published alongside this CVE.
// Refer to the external references for technical details.

Detection Methods for CVE-2026-114266

Indicators of Compromise

Web server access logs showing requests to profile.php with SQL meta-characters such as ', --, UNION, or SLEEP( in the admin_id parameter.
Unexpected database errors or query latency spikes correlated with requests to profile.php.
Unauthorized changes to administrator records or new rows in the users or admin tables.

Detection Strategies

Deploy a web application firewall (WAF) ruleset that inspects the admin_id parameter for SQL injection signatures.
Enable MySQL general or audit logging and alert on queries containing concatenated administrator identifiers combined with keywords like UNION, INFORMATION_SCHEMA, or BENCHMARK.
Correlate authentication events with subsequent anomalous queries from the application service account.

Monitoring Recommendations

Monitor outbound traffic from the web host for data exfiltration patterns following suspicious profile.php requests.
Track failed and successful logins for administrator accounts and alert on sudden privilege changes.
Review database query volume baselines for profile.php and flag deviations.

How to Mitigate CVE-2026-114266

Immediate Actions Required

Restrict network exposure of the Advanced Library Management System to trusted administrative networks or place it behind a VPN.
Enforce least-privilege database credentials so the application account cannot modify administrative tables beyond required operations.
Rotate administrator passwords and audit the admin table for unauthorized entries created since deployment.

Patch Information

No vendor patch is referenced in the published CVE record. Operators should monitor the GitHub Project Repository for updates. Until a fix is available, apply code-level remediation by replacing the vulnerable mysqli_query call with a prepared statement using mysqli_prepare and bound parameters for admin_id.

Workarounds

Add server-side validation that enforces a strict numeric type for admin_id before query construction.
Deploy a WAF rule that blocks SQL meta-characters in the admin_id parameter of profile.php.
Disable or remove the profile.php endpoint if it is not required for operational use.

bash

# Configuration example
# Example ModSecurity rule to block SQLi attempts targeting admin_id in profile.php
SecRule REQUEST_URI "@contains /profile.php" \
    "id:1026114266,phase:2,deny,status:403,\
     chain,msg:'CVE-2026-114266 SQLi attempt on admin_id'"
    SecRule ARGS:admin_id "@detectSQLi" "t:none,t:urlDecodeUni"