This vulnerability affects code-projects Easy Blog Site up to version 1.0. It involves an SQL injection flaw triggered by manipulating the 'Name' parameter in the /users/contact_us.php script. The injection allows an attacker to execute arbitrary SQL commands remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector and low complexity. No official fix or patch has been disclosed, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the impact is rated medium and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall (WAF) rules to block malicious SQL injection attempts targeting the 'Name' parameter in /users/contact_us.php. Monitor for updates from the vendor regarding patches or official mitigations.