ProjectWorlds ALMS EUVD-2026-107415

Exploitation requires an authenticated session with high (administrative) privileges on the Advanced Library Management System, as the vulnerable code is the member-edit function in edit_member.php. The attacker must supply malicious SQL in one of the specific parameters firstname, middlename, lastname, address, branch, or type. No user interaction is needed (UI:N) and no non-default configuration is required, but the PR:H authentication requirement is the primary limiting factor - an unauthenticated or low-privilege user cannot reach the vulnerable function. A public GitHub exploit reduces the technical barrier for an attacker who meets the privilege requirement.

This is a medium-severity SQL injection (CWE-89) in ProjectWorlds Advanced Library Management System 1.0 with a CVSS 4.0 base score of 5.1. The vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-reachable, low-complexity exploitation, but PR:H means the attacker must already hold high (administrative) privileges on the application, which substantially reduces real-world risk - a pre-authenticated admin injecting SQL is a limited threat model. Impact is rated low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), and scope is unchanged (SC:N/SI:N/SA:N), so this is not a full database-takeover-grade finding per the supplied vector. Public exploit code exists (E:P in the vector and a GitHub exploit reference), raising the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. Net assessment: a genuine but low-priority issue - the combination of an obscure academic/hobby PHP product and a PR:H prerequisite outweighs the fact that a POC is public. Note a mild tension worth verifying: the description says 'Remote exploitation is possible' and the vector is AV:N, yet the injection lives in an administrative member-edit function requiring high privileges, so 'remote' here means network-reachable-after-authentication rather than unauthenticated remote.

An attacker who already holds administrative (high-privilege) access to the library management application navigates to the member-edit page (edit_member.php) and submits crafted input in the firstname, middlename, lastname, address, branch, or type field. Because the parameters are concatenated into a SQL query without sanitization, the injected payload executes against the backend database, allowing the attacker to read or tamper with stored records. Public exploit code for this exact file is available on GitHub, lowering the skill needed to reproduce the attack.