A critical SQL injection vulnerability in code-projects Online Music Site 1.0 exposes the application to remote, unauthenticated database manipulation.

This is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminEditUser.php file. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands via the ID parameter.

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive user data, administrative credentials, or potential system compromise. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized database access.

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the /Administrator/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the AdminEditUser.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's write-up at the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability presents a significant risk to the integrity of the affected application. Organizations must prioritize restricting access to the administrative interface and implementing WAF protections until a formal vendor security update is released and applied.