The flaw exists in the /crud.php file of code‑projects Simple IT Discussion Forum 1.0, where an unvalidated user_Id parameter enables attackers to insert arbitrary SQL commands. This classic SQL injection, captured by CWE‑74 and CWE‑89, allows unauthorized execution of SQL, potentially exposing, modifying, or deleting forum data. An exploit has been released publicly, confirming the vulnerability is known to adversaries.

The only affected product is code‑projects Simple IT Discussion Forum version 1.0. Users running this version should verify whether an updated release that addresses the injection has been issued.

The base severity score of 6.9 indicates a moderate but significant risk. The existence of a public exploit and the possibility to attack remotely without special prerequisites suggest a high likelihood of exploitation. Although not yet listed in the CISA Known Exploited Vulnerabilities catalog, the remote nature and severity of this vulnerability make it a high priority for mitigation. Attackers can manipulate the user_Id parameter to execute arbitrary SQL, potentially compromising the confidentiality, integrity, and availability of the forum database.