CVE-2026-78200: Library Management System 1.0 SQL Injection

CVE-2026-78200 Overview

CVE-2026-78200 is a SQL injection vulnerability in itsourcecode Library Management System 1.0. The flaw exists in the editbooks.php script, where the ID parameter is passed to the backend database without proper sanitization. A remote authenticated attacker can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public disclosure has occurred through VulDB entry #394577 and a corresponding GitHub issue, and exploit details are publicly available.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL queries through the editbooks.php ID parameter, leading to unauthorized data access, modification, or database enumeration.

Affected Products

itsourcecode Library Management System version 1.0
Deployments exposing editbooks.php to authenticated users
Downstream forks or derivatives reusing the vulnerable editbooks.php handler

Discovery Timeline

2026-08-24 - CVE-2026-78200 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78200

Vulnerability Analysis

The vulnerability resides in editbooks.php, a server-side PHP script responsible for editing book records within the Library Management System. The ID parameter reaches a SQL query without parameterization or type enforcement. Attackers can append SQL operators, UNION clauses, or boolean predicates to alter query semantics. Successful exploitation yields limited confidentiality, integrity, and availability impact against the backing database. The Exploit Prediction Scoring System (EPSS) probability for this CVE is 0.251% as of 2026-08-27.

Root Cause

The application concatenates the user-supplied ID value directly into a SQL statement. It performs no prepared statements, escaping, or input validation before query execution. This absence of neutralization for special SQL characters maps directly to CWE-74.

Attack Vector

The attack occurs remotely over the network against the web application. The attacker requires low-privilege authenticated access to reach the vulnerable endpoint. Exploitation requires no user interaction. Public exploit material is referenced in the VulDB submission #886157 and associated GitHub issue.

No verified exploit code is republished here. Refer to the published references for technical proof-of-concept details.

Detection Methods for CVE-2026-78200

Indicators of Compromise

HTTP requests to editbooks.php containing SQL meta-characters such as ', ", --, ;, or UNION SELECT in the ID parameter.
Web server access logs showing repeated variations of the ID value from a single source address within a short time window.
Database error messages surfaced in HTTP responses referencing MySQL syntax faults tied to the editbooks.php handler.

Detection Strategies

Deploy web application firewall signatures that inspect the ID query parameter of editbooks.php for SQL syntax tokens.
Enable database query auditing to flag queries against the books table that contain tautologies such as OR 1=1 or stacked statements.
Correlate authenticated session identifiers with anomalous query patterns to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Monitor outbound data volume from the database host for signs of bulk extraction following requests to editbooks.php.
Alert on HTTP 500 responses generated by editbooks.php that coincide with malformed ID values.
Retain web and database logs for at least 90 days to support retrospective hunting once new indicators emerge.

How to Mitigate CVE-2026-78200

Immediate Actions Required

Restrict network access to the Library Management System to trusted users pending remediation.
Disable or restrict the editbooks.php endpoint until an updated build removes the injection sink.
Rotate database credentials if evidence of exploitation is present in access or query logs.

Patch Information

No vendor patch has been published for itsourcecode Library Management System 1.0 at the time of NVD publication. Track the VulDB advisory and the upstream itsourcecode project page for release announcements. Operators maintaining forks should refactor editbooks.php to use parameterized queries with PDO or MySQLi prepared statements.

Workarounds

Cast the ID parameter to an integer in editbooks.php before it reaches the SQL query, rejecting non-numeric input.
Apply a WAF rule that blocks requests to editbooks.php where the ID parameter contains non-digit characters.
Enforce least-privilege database accounts so the web application user cannot execute DROP, ALTER, or cross-database queries.

bash

# Example ModSecurity rule to block non-numeric ID values on editbooks.php
SecRule REQUEST_URI "@contains /editbooks.php" \
    "chain,phase:2,deny,status:403,id:1026078200,msg:'CVE-2026-78200 SQLi attempt'"
    SecRule ARGS:ID "!@rx ^[0-9]+$" "t:none"