A critical SQL injection vulnerability in the projectworlds Advanced Library Management System allows unauthenticated remote attackers to compromise the application database.

This is a SQL injection flaw (CWE-89) located in the delete_member.php file. The vulnerability allows an unauthenticated, remote attacker to manipulate the user_id parameter to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject SQL queries poses a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized data exfiltration, modification of library records, or potential administrative account takeover. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized database access.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the vulnerable delete_member.php file or disable the affected module entirely until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected parameters directed at the delete_member.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to block or sanitize malicious input patterns targeting SQL injection vectors in the user_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to affected installations. Administrators must prioritize restricting access to the vulnerable component and implement defensive WAF rules immediately. Monitor vendor communication channels closely for the release of a permanent patch, which should be applied as soon as it becomes available.