The loginuser.php script accepts email and password parameters without proper filtering, enabling an attacker to inject arbitrary SQL statements. This injection can expose sensitive user information, modify account details, or potentially gain unauthorized database access. The flaw falls under CWE-74 and CWE-89, representing inadequate handling of query parameters and SQL injection.

code-projects Online Lot Reservation System version 1.0 and earlier are affected. The vulnerability resides in the loginuser.php file and can be triggered by passing crafted email/password values over the network.

The CVSS score of 6.9 indicates a medium severity with a remote attack vector. The EPSS score is not available and the issue is not listed in CISA KEV, but the publicly disclosed exploit demonstrates feasibility. An attacker can remotely send a malicious request to /loginuser.php, inject SQL, and retrieve or alter data. Due to the lack of a published fix, the risk remains ongoing until a vendor update or a mitigated configuration is applied.