This vulnerability affects code-projects Task Management System 1.0. It arises from improper sanitization of the task_id argument in the /user/comment_count_user.php file, allowing remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and the lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the task_id parameter.