The vulnerability is a classic SQL injection in the commentList.asp script of ASP‑CMS. By manipulating the id parameter in a GET request, an unauthenticated attacker can embed arbitrary SQL, including the keyword 'master', to bypass the application’s keyword blocklist and retrieve sensitive database information. This flaw allows attackers to read, modify, or delete database records, potentially leading to loss of data integrity or confidentiality. The weakness is classified as CWE-89.

The flaw exists in ASP‑CMS, a content management system project. No specific version range is listed in the advisory, so all releases that contain commentList.asp may be vulnerable until a fix is released.

The CVSS base score is 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated, remote via an HTTP GET request to the commentList.asp endpoint; this is inferred from the description. Exploitation requires only knowledge of the vulnerable URL and parameter, making the incident probability significant if a public-facing instance of ASP‑CMS is present.