This vulnerability affects SourceCodester Photo Share Website 1.0. An attacker can exploit improper input validation on the 'email' argument in the login AJAX handler (/social/ajax.php?action=login) to perform SQL injection attacks remotely. The vulnerability allows attackers to manipulate backend database queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the vulnerability is publicly known with exploit code available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the email parameter in the login AJAX request. This may lead to unauthorized data disclosure, data modification, or other database impacts. The overall impact is rated medium severity based on CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint. Review and harden input validation and parameter sanitization in the affected component if possible.