The Online Lot Reservation System version 1.0 from code-projects contains a SQL injection vulnerability in the /loginuser.php file. Specifically, the vulnerability arises from improper handling of the email and password input parameters, allowing an attacker to inject malicious SQL commands remotely. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or vendor remediation level has been disclosed as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor for vendor updates. Until a patch is available, restricting access to the affected system and employing web application firewalls with SQL injection detection rules may help mitigate risk.