This vulnerability involves an SQL injection flaw in code-projects Employee Management System 1.0, specifically in the 370project/cancel.php file. By manipulating the id/token parameter, an attacker can inject SQL commands remotely. The CVSS 4.0 base score is 5.3 (medium severity), indicating that the attack vector is network-based with low complexity and no user interaction required. The vulnerability has been publicly disclosed but no vendor fix or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction, increasing the risk of attack. However, the impact is rated medium due to the low scope and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitor for any updates from the vendor regarding patches or official workarounds.