SourceCodester Comment System 1.0 contains a SQL injection vulnerability in the post_comment.php file. The vulnerability arises from improper handling of the 'Name' parameter, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited scope and impact metrics. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the post_comment.php endpoint. Input validation and sanitization on the 'Name' parameter should be enforced as a temporary mitigation.