This vulnerability affects SourceCodester Ship Ferry Ticket Reservation System up to version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the Username parameter in the /admin/login.php file's Admin Login component. This allows unauthorized SQL commands to be executed against the backend database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official remediation or patch has been published as of the vulnerability disclosure date.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low confidentiality, integrity, and availability metrics, but it still poses a significant risk to the security of the affected system's data and authentication mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries on the Username input in the /admin/login.php file to mitigate SQL injection risks. Monitoring for updates from SourceCodester regarding patches or official mitigations is advised.