This vulnerability in Simple IT Discussion Forum 1.0 involves improper sanitization or validation of the 'content' parameter in /question-function.php, enabling an attacker to inject SQL commands. The attack vector is network accessible with no privileges or user interaction required, and the vulnerability has low to limited complexity to exploit. The CVSS 4.0 base score is 6.9, reflecting a medium severity impact with low confidentiality, integrity, and availability impacts. No official fix or patch has been identified, and the vendor has not provided remediation details.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access or modification depending on the database permissions. However, the impact is rated medium with low confidentiality, integrity, and availability impacts, indicating limited but non-negligible risk. The vulnerability can be exploited remotely without authentication, increasing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'content' parameter in /question-function.php to prevent SQL injection. Additionally, consider using web application firewalls to detect and block SQL injection attempts targeting this parameter.