The itsourcecode Online Discussion Forum 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

This flaw is a SQL injection (CWE-89) located in the /members/compose_msg.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries remotely.

The ability to perform remote SQL injection poses a significant risk to data confidentiality and integrity. If exploited, an attacker could potentially extract sensitive user information, modify database records, or bypass application logic, resulting in severe reputational damage and potential unauthorized access to the underlying server environment. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized data exposure.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web directory or disable the vulnerable messaging component until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting /members/compose_msg.php, specifically looking for SQL syntax patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads and malicious input strings.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a clear and present danger to affected systems. Organizations running itsourcecode Online Discussion Forum 1.0 must prioritize the implementation of compensating controls or remove the application from public-facing infrastructure until a vendor-supplied patch is successfully applied.