A flaw in the delete_post.php functionality allows an attacker to inject arbitrary SQL through the ID parameter. This remote input can modify the intended query, giving the attacker database access and the ability to read or alter data. The weakness is an improper input handling that leads to SQL injection, a notable risk on confidentiality and integrity.

The vulnerability exists in the Code-Projects Social Networking Site, specifically version 1.0, within the /delete_post.php file. The affected component is an unknown function that processes the ID argument for post deletion. Only the 1.0 release is documented as vulnerable.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is less than 1 %, implying a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending a crafted ID value to the public delete_post.php endpoint, achieving remote SQL injection without requiring local privileges.