ProjectWorlds ALMS EUVD-2026-107410

Exploitation requires network access to a deployed instance of ProjectWorlds Advanced Library Management System 1.0 where the individual_report_search.php report-search endpoint is reachable and accepts the roll_number parameter; no authentication, no privileges, and no user interaction are needed (PR:N/UI:N), and the injection reaches a mysqli_query call directly. The primary limiting factor is deployment exposure: this is a niche student/hobby application unlikely to be internet-facing in enterprise environments, and the specific individual_report_search.php report function must be present and accessible. No non-default configuration is stated as required.

Signals are mostly aligned toward a genuine-but-low-tier web vulnerability. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which normally warrants urgency; however, the impact metrics are uniformly Low (VC:L/VI:L/VA:L) and the subsequent-system scope is None, yielding only a 6.9 (Medium) base score. The E:P (Proof-of-Concept) threat metric corresponds to the publicly available exploit on GitHub, so exploit code exists but this is NOT confirmed active exploitation - the CVE is not in CISA KEV and no EPSS score was provided. The reporting source is VulDB, a crowd/automated feed whose SQLi entries for small PHP projects are often triaged generically rather than vendor-confirmed, so the Low-across-the-board impact rating should be treated cautiously (a classic unauthenticated UNION/boolean SQLi against a library database could realistically yield full read of credentials/PII, i.e. higher confidentiality impact than VC:L implies). Net: a real, easily-exploitable flaw in a niche product, but low operational priority for most enterprises because the affected software is a student/hobby PHP project with negligible production footprint. No KEV, no EPSS, and a self-published POC together suggest opportunistic rather than widespread targeted exploitation.

A remote, unauthenticated attacker submits a crafted value in the roll_number parameter to individual_report_search.php, which is passed unsanitized into a mysqli_query call, injecting SQL. A public proof-of-concept exists on GitHub, so an attacker can reproduce the injection directly to extract or manipulate library database records. Because no authentication or user interaction is required and complexity is low, exploitation is trivial once the endpoint is internet-reachable.