This vulnerability involves an SQL injection in the Visitor Management System 1.0 by code-projects, specifically in the /vms/php/phone_0.php file. An attacker can manipulate the 'phone' parameter to execute unauthorized SQL commands remotely. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium severity, indicating limited scope or complexity in exploitation consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk.