A critical SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /Administrator/PHP/AdminUpdateCategory.php file. The application fails to properly sanitize the txtcat argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

The ability to perform remote SQL injection allows an attacker to bypass authentication, extract sensitive data, or modify records within the application database. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to total compromise of the application backend and associated user information.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative directory or disable the affected Online Music Site instance until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /Administrator/PHP/AdminUpdateCategory.php, specifically looking for SQL syntax patterns or unexpected characters in the txtcat parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the identified vulnerable PHP endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk. Organizations utilizing code-projects Online Music Site 1.0 must prioritize isolating the affected application from public-facing networks to prevent potential exploitation until a remediation path is provided by the vendor.