A flaw in Z‑BlogPHP’s CommentBat feature permits an authenticated user to inject SQL statements through the id parameter, enabling arbitrary manipulation of the database. The vulnerability could be used to read, modify, or delete data, potentially compromising the integrity and confidentiality of the site’s content and infrastructure.

Z‑BlogPHP version 1.7.5 is affected. The vulnerability is tied to the CommentBat component accessed by authenticated users; it is inferred that those users must possess rights to submit or manage comments, as the description mentions authentication but does not specify the exact permission level.

The flaw is exploitable only to users with valid credentials, yet it grants unrestricted database access, which can lead to full data compromise or defacement. The EPSS score indicates a very low but non‑zero exploitation probability (0.00148) and the vulnerability is not listed in CISA’s KEV catalog. While the CVSS score of 8.1 indicates high severity, the need for credentialed access still suggests a serious risk profile. Monitoring for unauthenticated access attempts that transition to authenticated sessions and restricting database permissions are prudent while a patch is applied.