The Simple IT Discussion Forum 1.0 by code-projects contains a SQL injection vulnerability in the /functions/addcomment.php file. Specifically, the postid parameter is not properly sanitized, enabling an attacker to inject SQL commands remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, low complexity, and no required privileges or user interaction. No official fix or patch has been published as of the vulnerability disclosure date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the impact is rated medium due to limited complexity and the absence of confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the postid parameter in /functions/addcomment.php. Code review and manual input validation or sanitization of the postid parameter may also reduce risk.