An unauthenticated SQL injection vulnerability in Projectworlds Advanced Library Management System 1.0 poses a significant risk of unauthorized data access and database manipulation.

The application is vulnerable to SQL injection within the borrow_book.php script. An unauthenticated remote attacker can manipulate the roll_number argument to execute arbitrary SQL commands against the backend database.

The presence of an SQL injection flaw allows for the unauthorized retrieval, modification, or deletion of sensitive library data. Given the CVSS score of 7.3, this high severity vulnerability could result in full database compromise, leading to data breaches and potential loss of system integrity.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict network access to the application or take the system offline if it is exposed to the public internet.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unusual syntax, union-based queries, or attempts to access sensitive tables via the borrow_book.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the roll_number parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an urgent risk to any organization running the affected software. Security teams must implement strict access controls and WAF filtering immediately until the vendor provides an official security update to remediate the underlying code vulnerability.