This SQL injection in the comment_count endpoint of code-projects PHP task management software carries a CVSS 7.3, but the score is misleading in two directions that matter for defenders.
The 'authentication required' label inflates the perceived barrier. The /user/ path prefix suggests the endpoint is gated behind valid sessions, but task management systems of this class typically allow account creation via enumerated email addresses, and password reset flows grant full session access with nothing more than inbox control. The 'authenticated' constraint in CVSS assumes a meaningful credential bar — in this context, it's closer to 'anyone with a receiving email address,' which is a very low threshold that automated tooling solves instantly.
More critically, the authentication gate is temporal, not spatial. Once a public exploit exists — and the disclosure note confirms this — the 'authentication' step is a speed bump that mass-scanning tools remove in practice. This is a pivot vulnerability: successful injection reaches the full database, exposing task ownership, project assignments, user credentials, and potentially lateral movement paths if database credentials are shared across services.
The vendor profile compounds the risk. code-projects ships PHP applications as 1.0 releases with known security defects and provides no patch cadence. This is not a vendor who will issue a follow-up fix — the remediation timeline is entirely in your hands.
The practical conclusion diverges from what CVSS 7.3 would suggest. Do not treat this as a medium-severity vulnerability to be re-evaluated when bandwidth permits. Treat it as actively exploitable from the moment of public disclosure. Patch immediately, or if no patch is available, isolate the system from network access and treat it as a likely compromised asset. The window for deliberate prioritization closed when the exploit went public — the only defensible posture is urgent remediation or containment.