Projectworlds ALMS EUVD-2026-107039

Exploitation requires an authenticated session (CVSS PR:L) with access to the report_search.php reporting feature of projectworlds Advanced Library Management System 1.0; the attacker manipulates the dateto or datefrom date-range parameters, which are passed unsanitized to a mysqli_query call. No user interaction or non-default configuration is needed beyond having a valid low-privilege account. The main limiting factor is this privilege requirement plus the product's extremely narrow deployment - it is a demonstration/academic project rather than enterprise software.

This is a low-priority issue despite being a remotely exploitable SQL injection (CWE-89). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, driven by uniformly LOW impact ratings (VC:L/VI:L/VA:L) and the requirement for existing privileges (PR:L = authenticated). The E:P sub-metric and the GitHub reference confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a VulDB-reported injection flaw in a demonstration/tutorial PHP application with a public PoC but trivial real-world footprint. The low impact scoring is plausible for a report-search date filter, though SQL injection can often be escalated to full database disclosure, so the vendor-style VC:L/VI:L/VA:L may understate worst-case data exposure - treat the impact as at least confidentiality-relevant. Overall this is a high-noise, low-real-risk entry: genuine but minor, relevant chiefly to anyone actually running this specific project.

An authenticated user of the Advanced Library Management System submits a report search and tampers with the dateto or datefrom parameter sent to report_search.php, injecting SQL that the backend passes unsanitized into mysqli_query. Public exploit code for this exact endpoint is available on GitHub, lowering the skill needed to reproduce the attack and extract or manipulate report data from the backend database.