CVE-2026-109894

Summary

This SQL injection vulnerability in Booktics allows attackers to execute arbitrary SQL commands against the database without authentication, potentially leading to data exposure and manipulation. The flaw occurs when user input is not properly sanitized before being included in SQL queries.

Exploitability

Exploitation is straightforward with no authentication required, needing only network access to the vulnerable application to inject malicious SQL payloads into database queries.

Blast radius

If exploited, attackers could access and modify sensitive book inventory data, user information, and potentially escalate to full database compromise across all affected versions through 1.0.29.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.30 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.