CVE-2026-114039: SQL Injection in projectworlds Advanced Library Management System

This vulnerability affects projectworlds Advanced Library Management System 1.0. It arises from improper sanitization of input parameters dateto and datefrom in the mysqli_query call inside report_search.php, allowing an attacker to inject arbitrary SQL commands. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, and limited privileges required. Public exploit code has been released, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the limited scope indicated by the CVSS vector. There is no indication of privilege escalation or system compromise beyond the database.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting access to the vulnerable functionality and validating or sanitizing input parameters dateto and datefrom at the application level may reduce risk.