The vulnerability is a classic SQL injection flaw in SIM-PKH 2.4.1, where an attacker can inject code through the 'id' parameter in /admin/media.php. When an authenticated user sends a crafted GET request containing a UNION SELECT payload, the backend database is queried with the malicious input, allowing the attacker to retrieve usernames, database names, and version details. This flaw is classified as CWE-89 and can lead to unauthorized information disclosure and potential data manipulation through arbitrary SQL execution.

The affected product is Simpkh's SIM-PKH, specifically version 2.4.1. No other versions are known to be impacted. The vulnerability exists only within the admin media editing module accessed by authenticated users.

The CVSS base score of 7.1 indicates a high severity level, while the EPSS score is not available, making the current exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate and then target the /admin/media.php endpoint; however, the plain text nature of the ID parameter makes the exploit straightforward for those with legitimate access. Lack of mitigation in default deployments raises the risk profile for organizations still running version 2.4.1.