An unauthenticated SQL injection vulnerability exists in the projectworlds Online Notes Sharing Platform 1.0, posing a significant risk of data exposure or unauthorized access.

This flaw is a SQL injection vulnerability (CWE-89) triggered via the User parameter in the login.php script. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

The presence of a SQL injection vulnerability allows an attacker to interact directly with the application backend database. This risk includes the unauthorized disclosure of sensitive user notes or credentials, potential modification of application data, and overall compromise of the integrity of the platform. Given the CVSS score of 7.3, this is a high severity issue that requires immediate attention to prevent data breaches and maintain system availability.

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the login.php interface or disable the application until a security update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous SQL syntax patterns, such as UNION, SELECT, or comment characters, directed toward the login.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application login forms.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the provided GitHub reference.

Organizations currently running projectworlds Online Notes Sharing Platform 1.0 must treat this vulnerability with high priority. Because the exploit is public and the attack vector is unauthenticated, the risk of automated scanning and exploitation is elevated. Please implement the recommended compensating controls immediately and monitor the vendor's site for an official security patch to address the underlying code flaw.