A critical SQL injection vulnerability in Projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) affecting the index.php file. Unauthenticated attackers can inject malicious SQL commands via the keywords parameter, enabling unauthorized database interaction.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk due to the potential for remote exploitation without prior authentication. Successful exploitation may lead to the exfiltration of sensitive library data, unauthorized modification of records, or complete compromise of the backend database, resulting in significant operational disruption and data loss.

Immediate Action: Since no official patch is currently identified, restrict external access to the affected web directory and implement strict input validation for the keywords parameter in index.php.

Proactive Monitoring: Monitor database query logs for syntax errors or anomalous patterns associated with SQL injection attempts. Review web server logs for suspicious HTTP requests targeting the index.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block common SQL injection payloads in URL parameters to mitigate the risk of unauthorized exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the vulnerability disclosure on GitHub.

Given the high severity of this vulnerability and the existence of a public proof-of-concept, users are urged to treat this as an urgent security risk. Organizations should immediately implement the suggested compensating controls and monitor for signs of unauthorized database activity while awaiting a formal vendor patch.