This vulnerability allows unauthenticated attackers to inject arbitrary SQL payloads through several POST parameters in the Bootstrapy CMS forum and contact modules. By manipulating values such as thread_id, subject, post-id, and thread-id, attackers can execute arbitrary SQL statements against the underlying database, potentially extracting sensitive user data or causing a denial of service if the queries overload the database.

Bootstrapy CMS is affected. The vulnerability exists in the forum-thread.php, contact-submit.php, and post-new-submit.php modules. No specific version information is provided in the report.

The vulnerability has a CVSS score of 8.8, indicating a high severity level. No EPSS information is available, but an exploit is publicly documented in Exploit-DB, suggesting that attackers can leverage it with relative ease. The lack of a KEV listing does not diminish the risk, as the vulnerability is fully exploitable via standard HTTP POST requests to the mentioned endpoints.