ProjectWorlds Advanced Library Management System 1.0 contains a flaw in returned_book_search.php where the mysqli_query function is invoked with user‑supplied datefrom and dateto parameters that are not properly sanitized, enabling an attacker to inject arbitrary SQL. This flaw permits unauthorized data read or modification, representing a classic SQL injection vulnerability.

The affected product is ProjectWorlds Advanced Library Management System 1.0. The vulnerability resides in the Search Form component, specifically within returned_book_search.php that processes date range queries. No other versions are mentioned.

The CVSS v3 score of 5.3 indicates medium severity, but the existence of a publicly available exploit and the remote nature of the attack raise the practical risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can target the Search Form endpoint by crafting HTTP requests that include malicious datefrom/dateto values, potentially without authentication if access controls are absent.