The projectworlds Online Admission System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

The vulnerability is a SQL injection (CWE-89) occurring within the viewform.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands via the ID parameter.

The ability to perform SQL injection poses a significant risk to the integrity and confidentiality of the underlying database. Successful exploitation could lead to unauthorized data access, modification of student or system records, and potential disruption of administrative services. Given the CVSS score of 7.3, this represents a high-severity risk that demands prompt attention to prevent unauthorized access to sensitive institutional data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected web application or take the service offline until a secure version is released.

Proactive Monitoring: Review web server and application logs for suspicious patterns in URL parameters, specifically looking for common SQL injection syntax such as union, select, or comment characters originating from untrusted IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious input targeted at the ID parameter in viewform.php.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at https://github.com/huangtinlin/CVE/issues/1.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a credible threat to any deployment of the Online Admission System. Organizations should prioritize isolating the affected system from public networks immediately. Until the vendor provides a formal security update, the application should be considered insecure for production use.