An unauthenticated SQL injection vulnerability in the projectworlds Advanced Library Management System 1.0 allows remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) triggered by improper input validation of the book_id argument within the view_book.php file. The vulnerability is remotely exploitable without authentication.

Successful exploitation of this SQL injection flaw could lead to unauthorized access to sensitive library data, potential modification of database records, or denial of service conditions. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the availability and integrity of the application, potentially exposing the entire underlying database to malicious actors.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected file or the entire application via network-level controls until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed toward view_book.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the book_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations should prioritize isolating the affected component and implementing strict input validation rules at the WAF level to mitigate the risk of unauthorized database interaction until an official vendor patch is issued.