A remote SQL injection vulnerability in ProjectWorlds Advanced Library Management System 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL Injection (CWE-89) flaw located in the member_search.php file. The issue allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the roll_number argument.

The ability to perform remote SQL injection allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exposure or modification. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the confidentiality and integrity of library records and user information.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected file or disable the affected module until the vendor releases a security update.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or encoded characters targeting member_search.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

This vulnerability presents a clear risk to data integrity due to the ease of exploitation via simple URL parameter manipulation. Administrators are strongly advised to limit network exposure to the affected system and apply any forthcoming vendor updates immediately upon release to remediate the underlying code flaw.