{"id":"CVE-2026-123028","kind":"vulnerability","aliases":["CVE-2026-123028"],"related":[],"title":"itsourcecode Online Book Store: SQL injection via admin_edit.php bookisbn parameter","description":"A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admin_edit.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.","summary":"The itsourcecode Online Book Store 1.0 admin page admin_edit.php does not safely handle the bookisbn argument, allowing SQL injection. A remote attacker can run database queries and may read or change stored data, and a public exploit is said to exist.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Online Book Store","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["online-book-store","other","php","self-hosted"],"not_affected_if":["admin-page-not-deployed","blocked-from-internet"],"how_to_check":"- Check whether you run itsourcecode Online Book Store 1.0 and whether /admin_edit.php exists in the web root\n- Request /admin_edit.php without logging in; if it answers, treat it as exposed\n- Review admin_edit.php for the bookisbn request value used directly in an SQL query","fix":"No vendor or project fix found; NVD lists none. Mitigate by blocking /admin_edit.php from the internet or rewriting the query with prepared statements.","status":"open","published_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:17+00:00","updated_at":"2026-11-05T14:42:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T14:40:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"itsourcecode Online Book Store: SQL injection via admin_edit.php bookisbn parameter","impact":"high","summary":"The itsourcecode Online Book Store 1.0 admin page admin_edit.php does not safely handle the bookisbn argument, allowing SQL injection. A remote attacker can run database queries and may read or change stored data, and a public exploit is said to exist.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","online-book-store","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or alters the application's database remotely","analyst_note":"Confirm from NVD whether admin_edit.php requires an admin session and whether any vendor or project fix exists for Online Book Store 1.0.","how_to_check":"- Check whether the application is itsourcecode Online Book Store version 1.0 and whether admin_edit.php is present in its web root\n- Review admin_edit.php for direct use of the bookisbn request value in SQL queries\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["admin-page-not-deployed"],"who_is_affected":"Sites running the itsourcecode Online Book Store 1.0 PHP application with the admin_edit.php page reachable over the network. Installations where that page is blocked from the internet or not deployed are less exposed. The sources do not say whether authentication is needed to reach the page.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4218,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm from NVD whether admin_edit.php requires an admin session and whether any vendor or project fix exists for Online Book Store 1.0.","search":"'-123028':13A,16A '-2026':12A,15A '/admin_edit.php':91C '1.0':34B,79C 'admin':35B 'admin_edit.php':8A,37B 'affect':80C 'allow':45B 'argument':44B,96C 'attack':50B,108C 'avail':114C 'book':3A,18A,22B,32B,77C 'bookisbn':9A,43B,97C 'chang':59B 'cve':11A,14A 'data':61B 'databas':53B 'exist':69B 'exploit':65B,111C 'file':90C 'function':87C 'handl':41B 'host':28B 'identifi':73C 'initi':106C 'inject':6A,47B,101C 'issu':83C 'itsourcecod':1A,30B,75C 'lead':98C 'manipul':93C 'may':56B 'might':116C 'onlin':2A,21B,31B,76C 'online':17A 'online-book-stor':20B 'page':36B 'paramet':10A 'php':25B 'possibl':104C 'public':64B,113C 'queri':54B 'read':57B 'remot':49B,109C 'run':52B 'safe':40B 'said':67B 'self':27B 'self-host':26B 'sql':5A,46B,100C 'store':4A,19A,23B,33B,60B,78C 'unknown':86C 'use':118C 'via':7A 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted sites running itsourcecode Online Book Store 1.0 (a PHP sample/source-code project) with /admin_edit.php reachable. The CVE record scores it as needing no privileges (CVSS 4.0 PR:N from VulDB), but the NVD text does not say whether the page checks for an admin session, so assume it can be reached without login until you test. Anyone not running this application can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bookstore","onlinebookstore"],"ptokens":["book","online","store"],"labels":["high","onlinebookstore","other","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123028","severity":null,"published_at":"2026-11-05T14:17:04+00:00","modified_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123028:1787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123028","severity":null,"published_at":"2026-11-05T14:42:35+00:00","modified_at":"2026-11-05T14:42:35+00:00","first_seen_at":"2026-11-05T14:42:35+00:00","fetched_at":"2026-11-05T14:42:35+00:00","note":"NVD fetch returned only the description (page text not retrievable); no vendor fix or advisory found; sibling CVEs on the same app (book.php, edit_book.php, admin_delete.php) also unfixed. Auth requirement not stated in the sources; CNA vector says PR:N. Exploit stated public but no link found.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123028"]}],"documents":[{"id":76995,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123028","title":"NVD CVE-2026-123028","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}