A remote SQL injection vulnerability in projectworlds Gate Pass Management System 1.0 exposes the application to unauthorized database manipulation and potential data exfiltration.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the fullname parameter within the add-pass.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

The identified vulnerability carries a CVSS score of 7.3, reflecting a High severity risk due to the potential for remote, unauthenticated exploitation. Successful exploitation allows an attacker to compromise the integrity and confidentiality of the underlying database, which may lead to unauthorized data access or disruption of business operations related to gate pass management.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the add-pass.php endpoint via network controls or disable the affected module entirely.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the add-pass.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the fullname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk to affected systems. Organizations utilizing projectworlds Gate Pass Management System 1.0 must prioritize the implementation of compensating controls such as WAF filtering or network segmentation until an official vendor patch is released and applied.