A critical unauthenticated SQL injection vulnerability exists in code-projects Online Music Site 1.0, posing a significant risk of unauthorized database access and data exfiltration.

The application is vulnerable to SQL injection within the Administrator/PHP/AdminViewSongs.php file due to improper validation of the id parameter. This vulnerability is reachable by an unauthenticated attacker, allowing for the manipulation of database queries.

Successful exploitation of this vulnerability enables attackers to bypass security controls and access the underlying database, potentially leading to the theft of administrative credentials or sensitive user information. Given the CVSS score of 7.3, this flaw presents a high risk to the confidentiality and integrity of the application, which could result in significant reputational damage and data compromise.

Immediate Action: As there is currently no official vendor patch available, administrators should restrict network access to the administrative directory and consider disabling the vulnerable component until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests targeting AdminViewSongs.php, specifically looking for SQL syntax patterns in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application URL structure.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up on GitHub.

The presence of a publicly available proof-of-concept, combined with the lack of authentication required to trigger the flaw, necessitates immediate defensive action. Organizations utilizing this software must implement strict access controls and WAF filtering to mitigate the risk of exploitation until an official security update is provided by the vendor.