The vulnerability resides in SourceCodester Comment System 1.0, where the Name field in post_comment.php is improperly handled. An attacker can manipulate this argument to inject arbitrary SQL statements, potentially reading, modifying, or deleting data within the application's database. Since the input is incorporated directly into a query, the attack can compromise the confidentiality and integrity of stored information, including user content and possibly authentication data.

Affected systems are installations of SourceCodester Comment System version 1.0. The flaw occurs in the post_comment.php script processing user comments. No other versions or components are mentioned as affected.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, but the public exploit demonstrates that remote injection is feasible via a web request. The vulnerability is not yet listed in CISA KEV, yet the presence of a published exploit suggests a realistic threat that attackers can leverage from the Internet. Remote exploitation typically occurs through the public interface, allowing unauthenticated users to POST data to the comment endpoint. The lack of safeguards such as parameterized queries magnifies the risk.