This weakness sits in the SimplePress CMS 1.0.7 code path that processes the 'p' and 's' URL parameters without proper validation, enabling attackers to embed SQL fragments in GET requests. The vulnerability is a classic injection flaw (CWE‑89), and the official description states that through crafted payloads an unauthenticated user can execute any SQL statement against the backend database. Such manipulation can read or modify sensitive data, including usernames, database names, and version details, and potentially lead to full compromise of the hosting system if the database grants higher privileges.

The product affected is SimplePress CMS version 1.0.7, distributed by Sourceforge. No additional sub‑components or earlier versions are named in the report, making this single build the sole known vulnerable configuration.

The CVSS score of 8.8 indicates a high severity vulnerability. Because the flaw can be triggered via a simple HTTP GET request without any authentication, the attack vector is remote and open to any network user. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, but the existence of an exploitation proof in exploit‑db suggests real-world risk. An attacker who succeeds can read or modify database content, and if the database credentials are elevated, the compromise could extend to the underlying operating system.