A classic SQL injection flaw enables attackers to embed malicious SQL into the news ID parameter of the index.php endpoint. Because the application does not enforce authentication, anyone who can reach the publicly exposed URL can trigger the injection. Successful exploitation lets the attacker retrieve arbitrary data from the backend database, potentially exposing user credentials, site content, or configuration details.

Phpscriptsmall News Website Script version 2.0.5 is affected. No other major releases are listed as vulnerable in the available data.

With a CVSS severity of 8.8, the flaw poses high risk. The attack vector is clear: a direct HTTP GET request to /index.php/show/news/ with crafted input. The probability of exploitation is not quantified in the current data, but the absence of authentication and the straightforward injection path indicate a realistic threat. The vulnerability remains uncovered in the known exploited vulnerability catalog, underscoring that it may still be actively abused.