This vulnerability affects code-projects Simple Content Management System 1.0. It arises from improper sanitization of the ID parameter in the /web/index.php file, enabling an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Exploit code has been publicly released, increasing the risk of exploitation. No vendor-provided patch or fix is currently documented.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database via the ID parameter. This can lead to unauthorized data access, modification, or deletion depending on the database privileges. The impact on confidentiality, integrity, and availability is rated as low to limited, consistent with the CVSS vector. Since exploit code is publicly available, the risk of attacks is elevated despite the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter. Additionally, reviewing and sanitizing input handling in the affected file may mitigate risk. Monitor vendor channels for updates and apply official patches promptly once available.