CVE-2023-7109 is a SQL injection in the admin login page of code-projects Library Management System 2.0. It scores 7.3 (High), needs no prior access, and the record says the exploit has been disclosed. No fixed version is named, so take the app off public networks and rewrite its queries.
What's affected
The record lists Library Management System 2.0 from code-projects. The affected file is /admin/login.php and the argument is username.
No fixed version is given. The record states that the exploit has been disclosed to the public and may be used. It is not in CISA's KEV catalog, and I found no advisory stating active exploitation.
Severity note: the description says critical (the VulDB label for VDB-249004), while NVD scores the issue 7.3, High. Both appear in public records, and the title uses the score.
A login form is the worst place for this class of bug, because the code that decides who is an administrator is the code being attacked.
How to check if you're exposed
Check your own deployment, since this is a self-hosted PHP project.
find . -path "*admin/login.php"
grep -n "username" admin/login.php
If the username value is placed directly into a SELECT, the page is exposed. Also review the admin account list and recent admin logins in your database for entries you cannot explain.
What to do now
- Do not expose this application to the internet. Limit the admin path to a trusted network or VPN.
- Rewrite the login query in /admin/login.php to use a prepared statement, and compare password hashes in code, not inside a query string.
- Check the admin table for accounts you did not create, and reset all admin passwords.
- Use a database account for the app that cannot read other schemas or write files.
- Treat the project as unmaintained unless the vendor publishes a fixed release, and plan a replacement.
Why it matters
SQL injection is the classic result of building a database query by joining strings, so that a value the user supplied can change the meaning of the query instead of being treated as plain data. The weakness class is CWE-89. The durable fix is not a filter for bad characters. It is parameterized queries, where the query text and the values travel separately and the database never confuses one for the other.
Beyond the code fix, the account the application uses to talk to the database matters. An app that connects with broad rights turns a small bug into a large one. A narrowly scoped database user limits what a successful injection can read or change.
On a login page the impact is also about trust. If an attacker can change how the credential check is evaluated, the check itself stops meaning anything, whatever the strength of your passwords.
Quick check
Is CVE-2023-7109 fixed?
The record names no fixed version. Check the project page for a newer release before trusting any copy.
Does it affect only the admin login?
The record names /admin/login.php. A related CVE, CVE-2023-7110, covers the student login.php in the same product, so review both.
Sources
Last reviewed: 19 October 2026.
