A critical SQL injection vulnerability in the Projectworlds Advanced Library Management System allows unauthenticated remote attackers to compromise the underlying database.

This vulnerability is a SQL injection flaw located in the delete_book.php file. An unauthenticated remote attacker can manipulate the book_id argument to execute arbitrary SQL commands against the database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive library records, potential data exfiltration, or modification of database contents. With a CVSS score of 7.3, this flaw represents a high risk to organizational security and system reliability.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the affected file or disable the vulnerable component entirely.

Proactive Monitoring: Review web server access logs for anomalous requests to delete_book.php, specifically searching for suspicious SQL syntax or encoded characters within the book_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Security teams should prioritize isolating the vulnerable application from public network access and implement strict input validation or WAF filtering to prevent exploitation until a formal update is released.