There is a remote SQL injection flaw in the Simple IT Discussion Forum v1.0, situated in the add-category-function.php script. An attacker can manipulate the Category parameter to inject arbitrary SQL commands, allowing unauthorized access or modification of the database. This violation of input validation produces a classic SQL injection weakness (CWE‑74/CWE‑89). The impact includes potential data theft, tampering, or loss, undermining the confidentiality, integrity, and availability of the forum’s data.

Affected systems are the Simple IT Discussion Forum supplied by code-projects, specifically version 1.0. The vulnerability exists in the add-category-function.php file used for creating forum categories.

The severity of the flaw is classified as Moderate (CVSS 6.9). EPSS data is not available, and it is not listed in the CISA Known Exploited Vulnerabilities catalog, yet the vulnerability is publicly disclosed and exploitable over the network. The likely attack vector is remote HTTP requests that provide a malcrafted Category value to the script. Without mitigating controls, an attacker can inject SQL and compromise the underlying database.