A critical SQL injection vulnerability in the Online Music Site platform allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive information.

This vulnerability is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminReply.php file, which fails to properly sanitize the ID parameter. The attack can be triggered by an unauthenticated remote user via the network.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of user data, administrative credentials, or full application compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and loss of system confidentiality and integrity.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /Administrator/ directory using IP allowlisting or VPN-only access to prevent remote exploitation.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting AdminReply.php, particularly those containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting administrative endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to secure the administrative interface. If an official vendor update is not available, administrators must implement network-level access controls to ensure the vulnerable endpoint is not exposed to the public internet.