A remote SQL injection flaw exists in the handling of the post_id parameter within the content.php page of the Simple IT Discussion Forum. The missing input validation allows an attacker to inject arbitrary SQL statements. Successful exploitation can read, modify, or delete database contents, compromising confidentiality and integrity of forum data.

The vulnerability affects code‑projects' Simple IT Discussion Forum version 1.0, which is distributed through the code-projects.org project site.

The problem carries a CVSS score of 6.9, indicating moderate severity, and has no EPSS score available. It is not listed in the CISA KEV catalog. The described exploitation path involves an attacker sending a crafted request to the content.php endpoint, manipulating the post_id parameter to execute arbitrary SQL commands over the network. Because the flaw permits SQL execution remotely, an attacker could potentially compromise the entire database if no additional defenses are in place.