The flaw is a remote SQL injection vulnerability located in the topic-details.php file of the Simple IT Discussion Forum 1.0. The attacker can manipulate the post_id argument to inject SQL statements, falling under CWE‑74 (Insecure URL Manipulation) and CWE‑89 (SQL Injection). This allows unauthorized read, update, or delete of forum data, compromising confidentiality, integrity, and potentially availability of the application.

Vulnerable systems include installations of code‑projects Simple IT Discussion Forum version 1.0. The issue resides in the topic‑details page that processes the post_id parameter. No other product versions were explicitly identified in the advisory.

With a CVSS base score of 6.9 the vulnerability is considered high severity, and its public disclosure means attackers can craft HTTP requests to trigger the flaw from anywhere. The EPSS score is not available and the issue is not listed in the KEV catalog, but the lack of an available fix and the remote nature of the attack suggest a notable risk of exploitation. Exploitation requires only sending a crafted post_id value in a request to the forum, after which the attacker can execute arbitrary SQL against the backend database.