The vulnerability arises from improper handling of the 'User' argument in the login.php file of the Parameters Handler component. An attacker can inject arbitrary SQL through this parameter, allowing unauthorized access to, or manipulation of, the underlying database. Because the flaw is exploitable remotely, a malicious actor could retrieve sensitive data, alter records, or potentially execute further queries, creating significant confidentiality and integrity risks.

This issue affects Projectworlds Online Notes Sharing System version 1.0. It is not localized to any subcomponent beyond the login.php endpoint, and the flaw is present in that single version release.

The CVSS base score of 6.9 indicates a moderate severity level. While an exploit is publicly available and can be triggered remotely without requiring special credentials, no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog. Consequently, organizations using the affected version should prioritize patching or mitigating access to the vulnerable endpoint to reduce the likelihood of exploitation.