This vulnerability affects SourceCodester College Notes Gallery Management System 1.0 specifically in the /College/login.php file. An attacker can manipulate the User argument to inject SQL commands, leading to unauthorized database queries. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. The exploit code has been publicly disclosed, increasing the risk of exploitation. No patch or remediation information is provided in the available data.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges. The vulnerability is remotely exploitable without any user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the User parameter in login.php. Avoid exposing the vulnerable functionality to untrusted networks if possible.