This vulnerability involves an SQL injection in the itsourcecode CMS 1.0, specifically in the processing of the topic_id argument within the /admin/update_ss_img.php script. An attacker can remotely manipulate this parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with exploit code available, but no official patch or fix has been provided by the vendor yet.

Successful exploitation could allow an attacker to execute unauthorized SQL commands remotely, potentially leading to unauthorized data access or modification within the CMS database. The impact is rated medium based on the CVSS score of 5.3. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /admin/update_ss_img.php endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the topic_id parameter.