A SQL injection vulnerability exists in freeprojectscodes Sports Club Management System 1.0 in the /dashboard/admin/change_s_pwd.php file. The flaw is triggered by manipulation of the login_id argument and can be exploited remotely without authentication. Public exploit code is available. The vulnerability has a high severity rating with a CVSS score of 7.3.