CVE-2026-123028 itsourcecode Online Book Store admin_edit.php sql injection

Medium 6.9 Published 5 Nov 2026 Updated 6 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123028?

CVE-2026-123028 is a medium-severity vulnerability in itsourcecode Online Book Store, published on 5 Nov 2026.

Official description

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admin_edit.php. The manipulation of the argument bookisbn with the input 1%27%20AND%20GTID_SUBSET(CONCAT(0x71717a6b71,(SELECT%20(ELT(6040=6040,1))),0x716b6a7171),6040)--%20LpDt as part of String leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Weakness: CWE-89, CWE-74

Which versions are affected by CVE-2026-123028?

How do I fix CVE-2026-123028?

No fix has been published for CVE-2026-123028 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123028 being exploited?

There is no known exploitation of CVE-2026-123028 in the wild and no public exploit code.

Sources

Also known as GHSA-9p38-gfhx-fwq4.