The vulnerability exists in FeMiner Warehouse Management System in the chkuser.php file. An attacker can manipulate the Username argument to inject arbitrary SQL via the web interface, enabling remote execution of database commands. This flaw allows an attacker to read, modify or delete data, thereby compromising confidentiality, integrity, and potentially availability of the underlying database.

The flaw affects all FeMiner Warehouse Management System releases up to the commit identified by 9cad1f1b179a98b9547fd003c23b07c7594775fa. Version specifics are not published because the product follows a rolling release model. All installations deployed before the fix remain vulnerable.

The CVSS v3.1 score of 6.9 indicates medium severity. With an EPSS score below 1% the likelihood of exploitation is low, and the flaw is not currently listed in CISA’s KEV catalog, suggesting no widespread, publicly available exploits. However, the vulnerability is exploitable remotely over the network, requiring only access to the affected endpoint. Attackers could potentially inject SQL statements through the Username parameter, gain unauthorized data access or alter data if the database privileges are excessive. The lack of input validation and the absence of prepared statements enable the injection, consistent with CWE‑89.