This vulnerability in chetans9 core-php-admin-panel up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f allows remote attackers to perform SQL injection via manipulation of the filter_col parameter in the customers.php file. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor was contacted but did not provide any response or patch. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Exploit code is publicly available, though no active exploitation is confirmed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying manual code review and input validation on the filter_col parameter to mitigate SQL injection risks. Monitoring for updates from the vendor is recommended.