This vulnerability affects code-projects Simple IT Discussion Forum 1.0, specifically in the /add-category-function.php file. An attacker can remotely manipulate the Category parameter to perform SQL injection, potentially allowing unauthorized database queries or modifications. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or fix has been documented, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the forum's backend database. This may lead to unauthorized data access, modification, or deletion. The medium severity score reflects that while the attack is remotely executable without privileges, the overall impact on confidentiality, integrity, and availability is limited to low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and sanitization on the Category parameter to mitigate SQL injection risks. Monitoring for unusual database activity may also help detect exploitation attempts. No vendor-provided official fix or temporary workaround is currently documented.