A critical SQL injection vulnerability in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

This flaw is a SQL injection vulnerability (CWE-89) located within the user_id parameter of the view_member.php script. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious SQL commands into the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive library member data, potential database modification, or full database compromise. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of the system, potentially facilitating further unauthorized access to the hosting environment.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the vulnerable view_member.php file or disable the affected functionality entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual query patterns targeting the view_member.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Security teams should prioritize blocking access to the vulnerable endpoint and monitor for signs of unauthorized database interaction until a vendor-supplied patch is available.