This vulnerability affects the Online FIR System 1.0 by code-projects. It arises from improper sanitization of the email and password parameters in the /Login/checklogin.php component, enabling an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database via the login interface, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector. There is no evidence of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitor vendor channels for updates on patches or official remediation instructions.