A flaw in the login component of the Online Product Reservation System allows attackers to manipulate the emailadd argument and inject SQL statements. This vulnerability can enable remote attackers to bypass authentication, read or modify database contents, and potentially compromise the confidentiality, integrity, and availability of the system. The CVE describes the issue as a classic SQL injection that can be triggered from a web request without additional authentication.

cod‑projects Online Product Reservation System version 1.0, specifically the login.php file in the user login module. No other versions or products are listed as affected in the available data.

The CVSS score is 6.9, indicating a medium severity risk. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation is possible remotely via the web application’s emailadd input field and a public exploit has already been released, meaning an attacker only needs to host a malicious payload and send a crafted request to the vulnerable endpoint.