A remote SQL injection vulnerability in projectworlds Visitor Management System 1.0 poses a significant risk of unauthorized database manipulation by unauthenticated attackers.

The application fails to properly sanitize input provided to the dateF and dateP arguments within the query_data.php script, resulting in a SQL injection vulnerability that is exploitable by unauthenticated remote attackers.

Successful exploitation of this SQL injection vulnerability could allow an attacker to read, modify, or delete sensitive data stored in the application database. Given the CVSS score of 7.3, this is a high-severity issue that could lead to unauthorized information disclosure or total compromise of the visitor management records, resulting in significant operational and privacy impacts.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or disable the functionality until a vendor update is released.

Proactive Monitoring: Monitor web server access logs for anomalous requests to query_data.php containing SQL syntax characters, such as single quotes or comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests containing malicious SQL payloads targeting the dateF and dateP parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

The presence of a public proof-of-concept and the ease of exploitation via remote, unauthenticated requests make this a critical issue for organizations currently running this software. Administrators must prioritize isolating the vulnerable component from external access until a security update is provided by the vendor, as the ability to inject arbitrary SQL queries directly threatens the integrity of the application data.