CVE-2024-51060 identifies a SQL Injection vulnerability in Projectworlds Online Admission System version 1. The flaw exists in the 'a_id' parameter of the index.php script, which does not properly sanitize user input. This allows an attacker to inject malicious SQL queries remotely without authentication. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability. There is no information about available patches or fixes, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure and modification of sensitive data stored in the backend database of the Projectworlds Online Admission System. The attacker can execute arbitrary SQL commands remotely without authentication, compromising the confidentiality and integrity of the system's data. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the 'a_id' parameter to mitigate SQL Injection risks. Monitor vendor channels for updates and apply patches promptly once released.