The code-projects Project Management System version 1.0 contains a SQL injection vulnerability in the chk.php file's Login component. This vulnerability enables remote attackers to inject malicious SQL code due to insufficient input validation or sanitization in an unknown function. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database permissions and schema. However, the impact is rated medium due to limited scope and partial impact on confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's communications for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the chk.php Login component and review input validation controls if custom modifications are possible.