External risk intelligence

PMB Storage Module SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2023-53982

PMB (PhpMyBibli) is a web-based integrated library management system. The vulnerability exists in an endpoint designed for web interaction. As a public-facing web application used for managing library catalogs, these systems are commonly deployed with internet-facing interfaces to provide access to patrons and staff, making the web application surface reachable from the internet.

SQL Injection

Sigb Pmb

7.4.6

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the PMB (PhpMyBibli) library management system, specifically its storage module. A flaw in how the system handles requests allows remote attackers to manipulate database queries, potentially leading to data exposure or manipulation through time-based attacks. The main concern is to confirm if this specific version is in use and if it is exposed to external access.

Attackers can manipulate database queries remotely.
Matters if your library uses this software.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can reach the vulnerable component by interacting with a public-facing web application. This interaction involves sending specially crafted requests to a specific endpoint within the application. By manipulating parameters in these requests, attackers can trigger the vulnerability, potentially leading to unauthorized access to or modification of sensitive database information.

No authentication or special access needed.
Sends malicious input to `ajax.php`.
Risk of unauthorized database access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to manipulate database queries in systems running PMB version 7.4.6. Specifically, by injecting malicious input into the 'id' parameter of the storage module's ajax.php endpoint, an attacker could potentially extract sensitive information from the database through time-based blind SQL injection techniques.

Database queries and stored information.
Via a vulnerable web endpoint and parameter.
Information disclosure from the database.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SQL injection vulnerability in PMB's storage module impacts database integrity and requires immediate attention from teams managing the application and its underlying infrastructure. The first practical step involves identifying all instances of the affected PMB version, confirming internet reachability and business criticality, and then assigning ownership for remediation planning.

Application owners should manage remediation.
Verify internet exposure and criticality.
Plan maintenance for secure updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PMB software?

PMB, or PhpMyBibli, is a web-based integrated library management system. Libraries use this software to catalog resources and provide staff and patrons with an interface to search, manage, and interact with library collections over the web.

What does CVE-2023-53982 mean by SQL injection?

This is a security weakness categorized as CWE-89. It means the software does not properly filter user input before using it in a database query. In this specific case, an attacker can send malicious commands through a web request to trick the database into revealing information it should keep private.

How is this PMB vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted request to the 'ajax.php' endpoint within the storage module. The vulnerability specifically targets the 'id' parameter. It does not require the attacker to have a user account or any prior authorization to interact with the system.

Do I need to worry about this if my PMB instance is internal?

Halo Surface Signal identifies this as an external-facing risk because PMB is designed to be accessible to patrons and staff over the internet. While internal instances are less reachable by external attackers, any system accessible via a network interface should be evaluated for potential risk.

What should I do if I run PMB 7.4.6?

You should immediately identify where PMB is running in your environment. Once you have an inventory, confirm which instances are accessible via the internet and determine their business importance. Coordinate with your IT or application team to plan for updates to address the underlying database handling issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.