Twitter-Clone 1 contains a SQL injection flaw in follow.php that allows attackers to modify database queries through the userid parameter. By submitting union-based or time-based blind payloads, an adversary can retrieve usernames, passwords, and database credentials, resulting in confidential data exposure.

The flaw is present in the PHP-Twitter-Clone installation from Fyffe. No version range is supplied, so every deployment of this code that exposes follow.php is potentially affected.

The CVSS score of 8.8 indicates high severity. Although EPSS data is not available, the lack of a KEV listing suggests that the vulnerability is not yet widely exploited, but the attack vector is straightforward through a public HTTP endpoint, requiring no special credentials or privileges. An attacker can execute the injection remotely by forming an HTTP request to the vulnerable script.