horvey Library-Manager SQL Injection Vulnerability in Book Controller

A SQL injection vulnerability has been identified in horvey Library-Manager version 1.0. The issue resides in the BookController class, specifically within the index method, which improperly concatenates the bookId variable into SQL queries. This flaw allows for the manipulation of SQL statements, potentially leading to unauthorized data access or modification.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, navigate to the index.php file and access the Admin section. Inject a SQL payload into the bookId parameter, which is not properly sanitized before being used in SQL queries. The vulnerability can be verified using sqlmap, a tool that automates the process of detecting and exploiting SQL injection flaws.