This vulnerability in chetans9 core-php-admin-panel up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f allows remote attackers to perform SQL injection via the filter_col parameter in the customers.php file. The product is continuously delivered on a rolling release basis, so no discrete version numbers are provided. The vendor was contacted but did not respond, and no official remediation or patch information is available. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Exploit code has been published but no known active exploitation is reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. There is no indication of privilege escalation or system-level compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider applying manual code review and input validation or filtering on the filter_col parameter to mitigate SQL injection risks. Monitoring for updates from the vendor or community is recommended.