CVE-2024-3363 is a high severity (CVSS 7.3) SQL injection in SourceCodester Online Library System 1.0, reachable through the BookPublisher and BookTitle parameters of admin/borrowed/index.php. The record lists no fixed version, so treat the application as vulnerable until you patch the query or take it off the network. A public exploit is reported.
What's affected
The record names one product and one version: Online Library System 1.0 from SourceCodester, a library catalogue and borrowing application. The affected file is admin/borrowed/index.php, and the weakness is in how the BookPublisher and BookTitle input is used. The record says the attack can be launched remotely and that the exploit has been disclosed to the public.
The weakness class is CWE-89, improper neutralization of special elements in an SQL command. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms that is network reachable, low complexity, no user interaction, and the attacker needs no account. Confidentiality, integrity and availability impacts are each rated low.
I could not find a vendor advisory or a patched release. The references are third party write ups and the VulDB entry, VDB-259467. Nothing in the record says a fixed version exists, so do not assume one does. Check the project download page before relying on that.
The application is a PHP and MySQL library system. It stores member and borrowing records, and its admin pages hold the controls for the whole catalogue.
How to check if you're exposed
This is not a package you install with a package manager, so a dependency scan will not find it by name. Look for it the way you would look for any self hosted PHP app.
- Search your servers and repositories for the application name or for the file path
admin/borrowed/index.php. A command such asgrep -rl "index.php" /var/wwwshows where a copy is deployed. - Check the version. This record covers version 1.0, so any deployed copy of that release is in scope.
- Check whether the application is reachable from the internet or from a wider internal network than it needs.
- Review web server access logs for requests to that path that contain quote characters, SQL keywords or unusually long values in the BookPublisher and BookTitle input. Treat any hits as a reason to start an incident review.
- Confirm the database account the application uses. If it is a high privilege account, the damage from any injection is larger.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the libraries your projects pull in, which helps you find the other flaws around an app like this one.
What to do now
- Find every deployed copy of Online Library System and decide whether it still needs to exist.
- If it must stay, put it behind a VPN or an IP allow list and remove it from public access.
- Replace string built SQL for the BookPublisher and BookTitle parameters in
admin/borrowed/index.phpwith prepared statements and bound parameters. Validate the input type as well. - Move the application to a database account with only the permissions it needs. It should not own the schema or read other databases.
- Add a web application firewall rule as a stopgap, and keep database and web logs for at least the period since the April 2024 disclosure.
- Rotate any credentials stored in that database if you find signs of probing.
- Check the vendor page again for a patched release and note the result in your risk register.
Why it matters
The cause is simple. The code takes a value from the request and places it into an SQL statement without separating data from commands. When that happens, input can change what the query does. Prepared statements fix the whole class because the database never treats the value as SQL.
Admin scripts like this are often assumed to be hidden behind a login, but the record rates the flaw as reachable remotely, and file paths in small PHP apps are easy to guess. The record does not say this flaw is being exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list. The public disclosure of a working exploit is still enough reason to act, because it lowers the effort for anyone who finds a copy of the app online.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of Online Library System?
The record does not list one, and I did not find a vendor advisory. Check the project download page. Until a fixed release exists, restrict access and fix the query in your own copy.
Does CVE-2024-3363 appear in the CISA KEV list?
No. The record marks it as not known exploited. A public exploit exists, so treat it as likely to be tried, not as confirmed in use.
Sources
Last reviewed: 19 October 2026.
