A flaw in the /delete-category.php file of code-projects Simple IT Discussion Forum 1.0 allows a malicious attacker to supply a manipulated cat_id parameter. The application fails to validate or escape this input before inserting it into a SQL query, resulting in a classic SQL injection vulnerability. The flaw can be triggered remotely over HTTP, and the exploit is publicly available.

The affected product is code-projects Simple IT Discussion Forum version 1.0. No other product versions are listed as affected. The vulnerability resides in an unnamed function within the delete-category.php module.

The reported CVSS score of 6.9 indicates moderate‐to‐high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests containing malicious cat_id values to the delete-category.php endpoint without the need for authentication. Once exploited, an adversary could read or modify database records, potentially compromising confidential forum data or disrupting service. Given that the vulnerability is publicly disclosed and exploitable over the network, the likelihood of real‐world exploitation is considered significant.