The vulnerability exists in report_search.php of projectworlds Advanced Library Management System 1.0. By manipulating the dateto and datefrom parameters supplied to the mysqli_query call, an attacker can inject arbitrary SQL, allowing the execution of malicious statements that may read, modify, or delete database contents and potentially expose sensitive library data or compromise data integrity.

Any deployment of projectworlds Advanced Library Management System 1.0 that includes the vulnerable report_search.php script. The flaw is specific to that version; later releases may differ. Systems that expose the endpoint publicly are at higher risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. However, public exploit availability and the ability to execute the attack remotely mean that exposed systems can be targeted over the network, enabling unauthenticated data exfiltration or manipulation.