An unauthenticated SQL injection vulnerability in the projectworlds Visitor Management System 1.0 allows remote attackers to execute malicious database queries.

This is an SQL injection flaw (CWE-89) triggered by the improper sanitization of the rid argument within the front.php file. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform unauthenticated SQL injection poses a significant risk to the integrity and confidentiality of the underlying database. Depending on database permissions, an attacker could extract sensitive visitor information, modify records, or potentially gain further access to the host environment, justifying the 7.3 CVSS score.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected system or take the application offline until a secure version is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting front.php, specifically looking for SQL syntax patterns or unexpected characters in the rid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious query strings directed at the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an elevated risk to deployments of the projectworlds Visitor Management System. Organizations must prioritize restricting network access to the affected interface and remain vigilant for vendor updates to resolve this flaw permanently.