Projectworlds Online Notes Sharing System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the underlying database.

This flaw is a SQL injection (CWE-89) located in the login.php script. An unauthenticated attacker can supply a malicious payload through the user parameter to manipulate backend SQL queries, bypassing authentication or extracting sensitive information.

The ability for an unauthenticated attacker to manipulate database queries poses a severe risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to all stored notes, credential theft, or complete system compromise. Given the CVSS score of 7.3, this represents a high-severity risk that requires immediate attention to prevent unauthorized data exposure.

Immediate Action: As no official vendor patch is available, immediately restrict network access to the login page or take the application offline until the code is remediated. Developers should implement prepared statements with parameter binding to sanitize all user inputs before processing.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax errors or unexpected characters in the user parameter of POST requests to login.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the user parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the researcher's technical write-up on GitHub.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations currently running Projectworlds Online Notes Sharing System 1.0 should treat this as a high-priority issue. If the application cannot be patched using prepared statements, it must be isolated from the public internet to prevent unauthorized database access.