A vulnerability in ProjectWorlds Advanced Library Management System 1.0 enables an attacker to manipulate the admin_id parameter in the profile.php file, which is passed directly to the mysqli_query function without any validation or sanitization. This allows arbitrary SQL injection, letting an attacker read, modify, or delete database records. The flaw is an injection weakness (CWE‑89, CWE‑74) that compromises the confidentiality and integrity of the database.

The affected application is ProjectWorlds Advanced Library Management System version 1.0. The flaw resides in the PHP code within profile.php that accepts admin_id from the request and uses it unsafely in a SQL query. No additional version ranges are specified in the CNA data.

The CVSS score of 5.3 reflects moderate severity. EPSS data is not available, so the exploitation probability is uncertain, but the vulnerability has been publicly disclosed and can be exploited remotely. It is not listed in the CISA KEV catalog. A successful attacker can leverage the SQL injection to bypass authentication controls, exfiltrate sensitive data, or alter database contents if the database account has sufficient privileges.