Library CMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Library CMS version 1.0. This vulnerability allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Exploitation involves sending POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field, manipulating database queries to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized access by bypassing authentication mechanisms.

Reproduction

To reproduce this vulnerability, send a POST request to the admin login endpoint, including a boolean-based blind SQL injection payload in the username field. The injected SQL code can be used to manipulate database queries and bypass authentication.