The vulnerability arises from improper handling of the email argument in the Administrator Login component of itsourcecode News Portal Project 1.0. By manipulating the email parameter in /admin/index.php, an attacker can inject arbitrary SQL statements. This flaw permits unauthorized data exfiltration, modification, and deletion, and may serve as a stepping stone to more severe compromises. The weakness corresponds to the SQL injection categories reflected in CWE-74 and CWE-89.

Affected is itsourcecode News Portal Project update 1.0, the single publicly identified version containing the flaw. The embedded CPE string shows the application is at major version 1.0. No other product variants are listed.

The CVSS score is 6.9, indicating moderate severity, while the EPSS score of less than 1% signals low current exploitation probability. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list. Attackers can trigger the flaw remotely via HTTP requests to the /admin/index.php endpoint, and proof‑of‑concept scripts have already been released. Accordingly, the risk is moderate but warrants prompt mitigation.