A flaw in the aboutus.php script of itsourcecode News Portal Project 1.0 allows an attacker to manipulate the pagetitle argument, resulting in a SQL injection that can read, modify, or delete data from the underlying database. The weakness stems from insufficient input validation and the use of raw SQL statements, as indicated by the presence of CWE-74 and CWE-89 identifiers. If exploited, an adversary could gain unauthorized access to sensitive information stored in the portal's database, potentially impacting confidentiality and integrity. The severity is reflected in a CVSS score of 5.1, representing a moderate risk when considered alongside other factors.

The vulnerability is specific to the itsourcecode News Portal Project, version 1.0. The affected file is /admin/aboutus.php, which is exposed to the administrator interface. No other vendor or product versions are listed as impacted.

The reported exploitation is possible remotely, with publicly disclosed references indicating that attackers can trigger the injection from an external network. The EPSS score is less than 1%, suggesting a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, the path to exploitation remains straightforward: a remote user can supply a crafted pagetitle query parameter, causing the database to execute unintended SQL commands. Given the moderate CVSS score and the potential for data breach, organizations using this product should treat the issue as a moderate but actionable risk.