itsourcecode Online Book Store admin page SQL injection flaw

Online bookstore management software can leak its stored data.

Summary

The admin page (admin_edit.php) of itsourcecode Online Book Store 1.0 has an SQL injection flaw that can expose database contents. A public exploit exists, and attacks can be launched remotely.

What to do

No fixed version is named. Check that the program runs a version newer than 1.0, and read the vendor's advisory.

Products and platforms

itsourcecode Online Book Store

CVE IDs

CVE-2026-123028 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 14:00 UTC

First seen 2026-11-09 16:40 UTC