A critical SQL injection vulnerability in itsourcecode Online Discussion Forum version 1.0 permits unauthenticated remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

The application is susceptible to SQL injection (CWE-89) within the index.php file. An unauthenticated attacker can supply malicious input via the email or password parameters to manipulate backend database queries.

The ability for an unauthenticated user to perform SQL injection can lead to unauthorized data exfiltration, modification of user accounts, or total database compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could result in severe reputational damage and loss of administrative control over the forum platform.

Immediate Action: As no official vendor patch is currently available, administrators should restrict public access to the affected installation or disable the login functionality until a fix is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP POST requests to index.php containing SQL syntax or unusual character patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize input directed at the email and password parameters.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked GitHub repository.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations currently running version 1.0 of the Online Discussion Forum must prioritize isolating the application from external networks and implementing strict input filtering to prevent potential unauthorized database access.