This vulnerability affects code-projects Task Management System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the task_id argument in the /user/comment_count_user.php file. This allows unauthorized SQL commands to be executed on the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor-provided patch or official remediation has been documented as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication and requires no user interaction. However, the impact is rated medium due to limited scope or complexity factors indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts targeting the task_id parameter.