A vulnerability exists in the Simple IT Discussion Forum's question-function.php. The function accepts a user-supplied "content" argument that is used directly in a database query, allowing an attacker to inject arbitrary SQL. This flaw can be exploited remotely via the web interface and could enable unauthorized reading, modification, or deletion of forum data, as well as potential escalation to other database operations. The weakness is classified as CWE‑74 and CWE‑89.

The affected product is code‑projects Simple IT Discussion Forum, version 1.0. Only this specific version is reported to contain the vulnerable function, and the issue resides in an unknown internal function within the mentioned file.

The CVSS score of 6.9 indicates a moderate to high severity flaw, and the exploitation vector is remote. EPSS is not available and the vulnerability is not listed in KEV, suggesting it is not yet known as a widely exploited vulnerability. However, the public disclosure and confirmed exploitability mean attackers could realistically use the flaw to compromise the database. Mitigation should be applied promptly to prevent potential data breaches or service disruption.