The flaw is an unsanitized SQL query built from the email and password fields in the CheckLogin PHP script. The attacker can supply crafted input, causing the database to execute arbitrary SQL statements. This can expose or alter sensitive user data and potentially give the attacker non‑privileged access to the application’s back‑end. The vulnerability is a classic SQL injection, captured by the CWEs 74 and 89.

The affected product is code-projects Online FIR System version 1.0. No other products or versions were specifically mentioned. Users running this version should verify whether the CheckLogin module is in use, as the vulnerability exists in that component.

The CVSS score of 6.9 indicates medium severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. The exploit is available publicly and can be performed remotely via HTTP requests to the CheckLogin endpoint. An attacker does not need privileged credentials to trigger the injection, so the risk to confidentiality and integrity is significant if the database contains sensitive information.