A critical SQL injection vulnerability in the projectworlds Online Admission System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of unauthorized database access.

The application is susceptible to a SQL injection vulnerability (CWE-89) triggered via the a_id parameter in the adminlogin.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, extract sensitive information, or potentially modify database contents. Given the CVSS score of 7.3, this represents a high-severity risk to the confidentiality and integrity of the institutional data managed by the admission system. Such a breach could lead to severe reputational damage and the compromise of personal applicant records.

Immediate Action: As no official patch is currently available, administrators should restrict access to the adminlogin.php endpoint at the network or web server level until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting adminlogin.php, specifically monitoring for unusual characters or SQL syntax patterns in the a_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate potential exploitation attempts.

Public Exploit Available: Yes, a public exploit exists as evidenced by its presence in ExploitDB and a corresponding GitHub proof-of-concept repository.

The presence of a public exploit significantly elevates the risk profile for this vulnerability. Organizations using projectworlds Online Admission System 1.0 must prioritize implementing the suggested compensating controls immediately to prevent unauthorized access. Monitor vendor channels closely for the release of a security patch and apply it as soon as it becomes available.