The vulnerability stems from improper handling of the socid parameter in fourn/index.php. The original code directly accessed $_GET["socid"] without validation, making SQL queries using this parameter vulnerable to injection. The patch explicitly replaces $_GET access with GETPOST("socid", 'int'), which enforces type casting to an integer, neutralizing SQL injection vectors. This line change in the commit diff directly addresses the root cause, confirming the vulnerability's location and mechanism.