This vulnerability affects CodePanda Source canteen_management_system 1.0 specifically in the /api/login.php endpoint. An attacker can manipulate the Username argument to inject SQL commands, leading to unauthorized database queries. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor advisory or patch available, and no known exploits are reported in the wild yet.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may result in unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. The vulnerability is exploitable remotely without authentication, increasing its risk profile. However, no confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries on the Username parameter to mitigate SQL injection risks. Monitoring for unusual database activity may also help detect exploitation attempts.