CVE-2026-114039: projectworlds Advanced Library Management System report_search.php mysqli_query sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqliquery of the file reportsearch.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs network access to the affected application and low-privileged authenticated access. No user interaction is required, and exploitation is described as low complexity.
Which inputs should defenders focus on when assessing exposure?
The affected code is report_search.php, where the dateto and datefrom arguments reach mysqli_query. Review requests and application logs for suspicious values in those parameters, especially SQL syntax or unexpected query-like content.
Is public exploitation material available?
Yes. Public exploit information is available, so organizations should treat exposed instances as more likely to be targeted.
What is the potential impact of successful exploitation?
Successful SQL injection may affect confidentiality, integrity, and availability at a low impact level according to the supplied CVSS vector. The vulnerability is rated medium severity with a CVSS score of 6.3.