The Simple Flight Ticket Booking System version 1.0 contains a SQL injection vulnerability in the checkUser.php component's POST parameter handler. The vulnerability arises from improper sanitization of the 'Username' argument, enabling remote attackers to inject SQL code. This can lead to unauthorized database queries or data exposure. The vulnerability is publicly disclosed but no vendor patch or official fix has been provided yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may result in unauthorized data access, modification, or other database impacts depending on the application's database privileges. The CVSS 4.0 score of 6.9 indicates a medium severity with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious SQL injection payloads targeting the 'Username' parameter. Monitor for vendor updates regarding patches or official mitigations.