This vulnerability involves an SQL injection in the Simple IT Discussion Forum 1.0 by code-projects. The injection point is related to the user_Id parameter in a function within /crud.php. Because the attack vector is network accessible without authentication, an attacker can remotely exploit this flaw to manipulate backend SQL queries. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or mitigation has been published, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited scope of confidentiality, integrity, and availability impacts as per the CVSS vector. The vulnerability can be exploited remotely without authentication, increasing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the user_Id parameter. Restricting access to the vulnerable endpoint and monitoring for suspicious activity may also help reduce risk.