An unauthenticated SQL injection vulnerability in the Projectworlds Online Admission System 1.0 poses a significant risk of unauthorized database interaction and potential data exposure.

This is a SQL injection vulnerability (CWE-89) triggered via the keywords argument in the process_login.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

The ability to perform unauthenticated SQL injection allows an attacker to interact directly with the application database. This could lead to the unauthorized disclosure of sensitive applicant or user data, potentially resulting in severe reputational damage and compliance failures. With a CVSS score of 7.3, this flaw is categorized as High severity, necessitating immediate attention to prevent unauthorized data access.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the affected login endpoint using network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Monitor database query logs for unusual patterns, specifically looking for SQL syntax characters or unexpected keywords originating from the process_login.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the Online Admission System. Organizations currently hosting this software should prioritize isolating the application or implementing strict WAF filtering until the vendor provides a formal security update to remediate the underlying SQL injection flaw.