A remote, unauthenticated SQL injection vulnerability in projectworlds Advanced Library Management System 1.0 poses a significant risk of unauthorized database interaction.

The application is susceptible to a SQL injection flaw located in the view_admin.php file. An unauthenticated remote attacker can trigger this vulnerability by manipulating the admin_id parameter to execute arbitrary SQL commands.

The ability to perform unauthorized SQL queries against the underlying database can lead to data exfiltration, unauthorized modification of records, or potential administrative account compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could undermine the integrity and confidentiality of sensitive library data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected system or disable the vulnerable view_admin.php component until a fix is provided by the vendor.

Proactive Monitoring: Inspect web server access logs for anomalous requests containing SQL syntax patterns or suspicious characters targeting the view_admin.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the admin_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running version 1.0 of the projectworlds Advanced Library Management System must prioritize isolating the application from external networks and implementing strict input validation or WAF protections to mitigate the threat of SQL injection until a formal vendor patch is released.