An unauthenticated SQL injection vulnerability in code-projects Online Music Site 1.0 poses a significant risk to data integrity and system availability.

This vulnerability is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminDeleteUser.php file. It allows an unauthenticated remote attacker to inject malicious SQL queries by manipulating the ID parameter.

The ability for an unauthenticated attacker to inject arbitrary SQL commands into the backend database can lead to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a high-severity risk that could result in the compromise of user accounts or sensitive administrative information, directly impacting the confidentiality and integrity of the platform.

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the /Administrator/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests to the AdminDeleteUser.php endpoint, specifically looking for characters indicative of SQL injection, such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub repository referenced in the vulnerability record.

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates urgent attention. Because this flaw is unauthenticated and remotely exploitable, administrators must implement network-level access controls or WAF protections immediately to prevent potential database compromise. Constant monitoring for exploitation attempts is advised until a vendor-supplied security update is released and applied.