A critical SQL injection vulnerability in the projectworlds Advanced Library Management System allows unauthenticated attackers to compromise the underlying database.

The application fails to properly sanitize the admin_id parameter in the delete_admin.php file, allowing unauthenticated remote attackers to inject malicious SQL queries. This flaw permits direct interaction with the database backend without requiring any administrative credentials.

Successful exploitation of this vulnerability enables unauthorized database access, which can lead to sensitive data leakage, unauthorized modification or deletion of records, and potential full system compromise. Given the CVSS score of 7.3, the risk of data integrity loss and service disruption is high, particularly for systems managing library patron or administrative information.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the delete_admin.php file via network-level controls or disable the vulnerable component until a fix is released.

Proactive Monitoring: Inspect web server access logs for anomalous GET requests targeting delete_admin.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or sleep commands.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the admin_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research writeup by GYSakura.

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability poses a significant risk to the integrity of the affected system. Administrators must prioritize isolating the vulnerable application from public access and monitor for any signs of unauthorized database interaction until a formal security update is provided by the vendor.