A weakness in the add-category.php page allows an attacker to inject SQL through the Category field, enabling unauthorized manipulation of the underlying database. This is a classic input validation flaw (CWE‑74 and CWE‑89) and can be exploited remotely using a crafted request. Successful exploitation would allow an attacker to read, alter, or delete data within the administration area, potentially leading to full compromise of the content management system.

itsourcecode’s News Portal Project, version 1.0, as delivered from the /admin/add-category.php script, is affected. No other product versions are listed as impacted in the available data.

The vulnerability carries a CVSS score of 6.9, indicating medium severity. The EPSS score is less than 1%, suggesting a low to very low probability of current exploitation, and the issue is not in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the stated public availability of an exploit and the remote trigger via the Category parameter mean that an attacker could readily use this flaw to compromise the application if no controls are in place.