Library Management System WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Library Management System WordPress plugin, affecting versions prior to 3.5.8. The vulnerability arises because the plugin fails to properly sanitize and escape user-supplied parameters before incorporating them into SQL statements. This oversight allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to the extraction of sensitive data from the database, including user password hashes.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, enabling attackers to manipulate database queries and extract sensitive information, such as user password hashes.

Remediation

Users are advised to update the Library Management System WordPress plugin to version 3.5.8 or later.