A weakness exists in Easy Blog Site up to version 1.0 that permits the injection of arbitrary SQL through the Name parameter in the contact_us.php file. By manipulating this input, an attacker can execute unintended SQL commands against the underlying database. The impact may include unauthorized data retrieval or modification, depending on the database schema and the commands executed. The description does not specify the exact privileges or sensitive data that can be accessed, so the precise scope remains uncertain. The vulnerability is identified as a remote attack vector, and a public exploit has been released, indicating that remote exploitation is feasible without requiring authentication.

All installations of code‑projects Easy Blog Site running version 1.0 or earlier are affected. The contact_us.php page is publicly accessible, so any web server hosting this application can be targeted.

The CVSS score of 6.9 places the vulnerability in the medium‑to‑high range. A publicly available exploit and the ability to trigger the issue from any remote host increase the likelihood of real‑world attacks, even though the EPSS score is unavailable and the issue is not listed in KEV. Attackers must craft a request to contact_us.php and supply a malicious value for the Name field to exploit the injection