A SQL injection flaw exists in the /api/login.php endpoint of CodePanda Source canteen_management_system, introduced by unsanitized handling of the Username parameter. The flaw allows an attacker to inject arbitrary SQL commands, potentially exposing or modifying the data stored by the application.

The vulnerability affects CodePanda Source canteen_management_system version 1.0. Any deployment that exposes the /api/login.php API endpoint is susceptible; the affected functionality is not limited to a specific configuration.

The CVSS score of 6.9 indicates a moderate impact if exploited, while the EPSS score of less than 1% suggests a low current probability of exploitation. An attacker can perform the exploit remotely via an HTTP request without authentication, and a public exploit is available. The vulnerability is not listed in the CISA KEV catalog, but because the attack can be carried out with minimal effort, remediation is recommended.