The Simple Content Management System 1.0 contains a flaw in the index.php script that allows an attacker to supply a crafted value for the ID parameter. Because the value is incorporated directly into a SQL statement without sanitization, an attacker can inject arbitrary SQL. This can lead to data disclosure, alteration, or even undermine database integrity, and may serve as a foothold for further compromise. The weakness corresponds to SQL injection (CWE-74).

The affected software is code-projects Simple Content Management System version 1.0. No other affected versions are disclosed, so systems running that exact version are at risk.

The CVSS score of 6.9 indicates a moderate severity, but the fact that remote exploitation is possible and the exploit has been publicly released raises the overall risk. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the exact likelihood of exploitation cannot be quantified, yet the remote nature and moderate CVSS value suggest that administrators should treat this as a high-priority issue. Attackers could potentially gain unauthorized database access by sending malicious requests to the web application from the Internet.