Executive brief
Simple IT Discussion Forum is a web-based application used to host online community discussions. A security flaw in the way the application handles forum post requests allows an attacker to gain unauthorized access to the underlying database. This could result in the theft of sensitive user information, modification of forum content, or a complete disruption of the service.
Technical details
A SQL injection vulnerability exists in code-projects Simple IT Discussion Forum 1.0 within the '/pages/content.php' component. The root cause is the failure to properly sanitize or validate the 'post_id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing SQL payloads (including boolean-based blind, time-based blind, and UNION-based techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Simple IT Discussion Forum 1.0
Timeline
- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE-2026-5829 published.