Database read or write via login SQL injection

SQL injection in the Login Form in Code Projects Task Management System 1.0 allows remote attackers to read or modify data via the email parameter. The public index.php login handler passes the POST email value into Operation::select_with_multiple_condition, which concatenates user_email into a WHERE clause and executes it with $conn->query() without parameterization or escaping. No login is required because the flaw sits on the public login form; the published proof of concept demonstrates database enumeration, while broader data tampering depends on the database account's privileges.