This vulnerability involves an SQL injection flaw (CWE-89) in the Projectworlds Visitor Management System PHP v1.0. An attacker can remotely exploit the 'name' parameter in the myform.php endpoint to escalate privileges. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no user interaction, requiring some privileges but resulting in high confidentiality and integrity impact. No official patch or remediation guidance is currently available.

Successful exploitation allows an attacker with some privileges to escalate their privileges, potentially leading to unauthorized access or modification of sensitive data within the system. The confidentiality and integrity of the system are highly impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the 'name' parameter in myform.php. Avoid exposing the application to untrusted networks if possible.