A SQL injection vulnerability exists in projectworlds Advanced Library Management System 1.0 in the /borrowed_book_search.php file. Manipulating the datefrom or dateto arguments can lead to SQL injection. The vulnerability can be exploited remotely and public exploit code is available. The CVSS score is 6.3, indicating a medium severity.