Gate Pass Management System 2.1 contains an unauthenticated SQL injection flaw in the login-exec.php script. Attackers can embed SQL syntax in the login or password form fields, causing the application to execute the injected code and authenticate the user without valid credentials. This leads to unrestricted access to the entire application, enabling attackers to read, modify, or delete sensitive records. The weakness is identified as CWE-89, indicating that user input is concatenated directly into a query without validation or escaping.

The vulnerability affects Livebms Gate Pass Management System version 2.1. No other versions or components are listed as impacted.

With a CVSS score of 8.8, the flaw is considered high severity, and the lack of an available EPSS score suggests limited public exploitation data, though the vulnerability remains theoretically trivial to exploit over the web. Attackers only need the ability to send a POST request to the vulnerable endpoint; no privileged credentials or complex preconditions are required. Because the exploit allows session authentication to be bypassed, the entire application’s confidentiality and integrity are compromised.