A critical SQL injection vulnerability in ProjectWorlds Online Admission System 1.0 allows for remote, unauthenticated database manipulation.

This is a SQL injection vulnerability (CWE-89) located in the adminac.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands via the ID parameter.

The ability for an unauthenticated attacker to inject SQL commands poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized database access, data exfiltration, or modification of administrative records, resulting in potential service disruption and loss of sensitive information. The CVSS score of 7.3 reflects the high risk associated with remote, low-complexity attacks that do not require authentication.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable adminac.php endpoint or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Security teams should implement rigorous monitoring for anomalous database queries and review web server access logs for suspicious input patterns targeting the adminac.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the affected application parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate defensive action is required. Organizations using ProjectWorlds Online Admission System 1.0 must prioritize restricting network access to the application and monitor for signs of unauthorized database interaction until a formal security patch is provided by the vendor.