The MOGG web simulator Script contains a classic SQL injection flaw in the play.php endpoint. An unauthenticated attacker can supply a crafted id parameter in a GET request, causing the application to concatenate unsanitized user input into an SQL statement. This permits extraction of sensitive database contents such as usernames and potentially other data, compromising confidentiality. The weakness is categorizable as CWE-89.

The vulnerability is reported to affect all publicly available versions of the MOGG web simulator Script referenced as spider312:MOGG web simulator Script. No specific edition or version numbers are provided; therefore, all deployments of this script should be assumed vulnerable unless patched.

The CVSS score is 8.8, classifying the issue as high severity. EPSS data is not available, so the current exploitation probability cannot be quantified, but the lack of authentication requirements suggests the vulnerability could be exploited widely. The vulnerability does not appear in the CISA KEV catalog, indicating no confirmed field‑deployed exploitation yet, but the classic SQL injection vector makes it a strong candidate for automated exploitation tools.