CVE-2026-101110

Name of the Vulnerable Software and Affected Versions Book Library (Free) versions prior to 6.4.6

Description An unauthenticated SQL Injection exists in the books() function within the site/booklibrary.php file. The issue occurs when the function processes the field and direction request parameters. These parameters are passed through the protectInjectionWithoutQuote() function, which uses a keyword blacklist to detect the substring select. If detected, the value is wrapped in a quoting function; however, the value is subsequently concatenated directly into an unquoted ORDER BY clause, where quoting is ineffective. Exploitation requires an initial request to set session-stored sort defaults and the use of a decoy comment (-- xselect) to bypass the blacklist check.

Recommendations Update Book Library (Free) to version 6.4.6 or later. As a temporary mitigation, restrict access to the site/booklibrary.php endpoint.