This vulnerability affects CodePanda Source canteen_management_system 1.0, specifically in the /api/login.php endpoint. An attacker can manipulate the Username argument to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required. No official patch or vendor advisory is currently available, and the exploit code is publicly known.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database impacts depending on the database configuration and privileges. The vulnerability affects authentication functionality, which could further facilitate unauthorized access or bypass authentication controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the Username parameter to prevent SQL injection. Monitoring for exploitation attempts is advised given the public availability of exploit code.