An attacker manipulating the ID argument in the file /pages.php can inject arbitrary SQL statements into the underlying query. This flaw allows the exploitation of unvalidated input to gain unauthorized database access, potentially exposing, modifying, or deleting sensitive data. The vulnerability is categorized as a typical SQL injection weakness, which can lead to data breach or further escalation if combined with other weaknesses.

The affected product is code-projects Content Management System version 1.0. The vulnerability exists in an unknown function within the pages.php script of this system.

The issue carries a CVSS score of 6.9, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low likelihood of exploitation in the near term. It is not listed in the CISA KEV catalog, and the attack can be performed remotely. Exploitation requires only the ability to supply a crafted ID parameter, so the attack is feasible for anyone who can hit the web interface.