A critical SQL injection vulnerability exists in the Projectworlds Online Admission System 1.0, which may allow unauthenticated remote attackers to compromise the database.

The vulnerability is a SQL injection flaw (CWE-89) located in the viewdoc.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the ID parameter, potentially leading to unauthorized data access or manipulation.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive student or institutional data stored within the system database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches and potential loss of system integrity.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the vulnerable viewdoc.php file or take the application offline until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate automated SQL injection attempts against the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/Sunhaobin318/CVE/issues/2.

The presence of a public proof-of-concept combined with the unauthenticated nature of this attack makes CVE-2025-8436 a significant risk to the availability and confidentiality of the Online Admission System. Organizations must prioritize restricting access to the affected endpoint immediately and maintain vigilant monitoring until an official vendor update is provided.