Shuosheng

An issue exists in the Login Endpoint within the file `/img/user%20page.php` where the `mysqli query()` function fails to properly handle the `Username` variable. This allows a remote attacker to perform SQL injection, a technique used to manipulate database queries to gain unauthorized access or retrieve sensitive data.

A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

The issue is related to Cross Site Request Forgery (CSRF) in the `head code` or `foot code` parameters. This means an attacker could potentially trick a user into performing unintended actions on the web application.