PT-2020-16919 · Sourcecodester · Sourcecodester Library Management System

Published 2020-12-23 · Updated 2020-12-23 · CVE-2020-28073

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Library Management System version 1.0

Description The issue allows an attacker to bypass user authentication and impersonate any user on the system through SQL Injection.

Recommendations For SourceCodester Library Management System version 1.0, consider implementing proper input validation and sanitization to prevent SQL Injection attacks. As a temporary workaround, restrict access to sensitive user authentication modules until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-28073

Affected Products

Sourcecodester Library Management System

References · 6

• 🔥 http://packetstormsecurity.com/files/160606/Library-Management-System-1.0-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28073 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28073 · Vendor Advisory
• https://sourcecodester.com/php/14545/online-library-management-system-phpmysqli-full-source-code-2020.html · Note
• https://t.me/cvenotify/7649 · Telegram Post
• https://t.me/cibsecurity/21239 · Telegram Post