This vulnerability affects SourceCodester/jkev Record Management System 1.0, specifically an unknown functionality within the index.php file of the Login component. An attacker can manipulate the Username parameter to perform SQL injection attacks remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, and a public exploit exists, but no vendor patch or official fix has been documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the CVSS vector indicates limited confidentiality, integrity, and availability impact, consistent with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. In the meantime, consider applying input validation or web application firewall (WAF) rules to filter or block malicious SQL injection attempts targeting the Username parameter in the Login component.