A classic SQL injection flaw exists in Support Board version 3.7.7, where an attacker can use the calls[0][message_ids][] parameter in the /supportboard/include/ajax.php endpoint to read, create, update, and delete data from the backend database. The vulnerability allows direct manipulation of the SQL statements executed by the application, giving full control over stored data.

The affected product is Schiocco Support Board. The vulnerability is present in version 3.7.7. The vendor has released an official fix in version 3.7.8, published in February 2025.

The CVSS score of 8.7 signals a high severity condition. The EPSS metric is below 1 % and the issue is not listed in the CISA KEV catalog, indicating that publicly documented exploits are unlikely at this time. The attack vector is inferred to be remote, as the vulnerable endpoint is reachable via standard web requests on the public or internal network. If exploited, an attacker could compromise the confidentiality, integrity, and availability of the database, potentially exposing sensitive information or disrupting service.