A remote attacker can manipulate the fid or id parameter in files.php to inject SQL, allowing read, modify, or delete operations on the backend database. This risk exposes sensitive information and compromises application integrity. The exploit is publicly available and can be launched over the network, increasing its potential impact.

The flaw exists in the open‑source project oretnom23/file‑management‑system‑php. Because the project follows a rolling release model, specific affected commits are not enumerated, but any deployment of the repository before a fix is vulnerable. No published version currently contains the patch.

With a CVSS score of 6.9 this vulnerability is moderately severe. Although the EPSS score is not provided, the publicly available exploit demonstrates that attackers can target it remotely. The lack of a KEV listing indicates it is not widely disseminated, yet the remote attack vector and absence of a patch heighten the risk of exploitation.