MGB OpenSource Guestbook 0.7.0.2 contains a SQL injection vulnerability exploitable via the email.php script. The flaw allows unauthenticated users to inject arbitrary SQL code through the 'id' GET parameter, enabling the execution of any SELECT or other SQL statements on the underlying database. Attackers can retrieve sensitive information such as table names, column names, and stored data, thereby compromising the confidentiality of the application’s database.

The vulnerable product is M-Gb MGB OpenSource Guestbook version 0.7.0.2. Only this released version is known to contain the flaw; newer iterations not listed in the data may include the fix. Users of this application should verify their installed version and apply any available updates.

The CVSS score of 8.8 indicates a high severity vulnerability, and while the EPSS score is not available, the absence of KEV listing does not reduce its threat level. The vulnerability is exploitable through a simple HTTP GET request to the public email.php endpoint, making it remotely reachable. An attacker can read database information and potentially use retrieved credentials to compromise other systems.