A critical SQL injection vulnerability in code-projects Online Music Site 1.0 enables unauthenticated remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

This is a SQL injection vulnerability (CWE-89) located in the /Administrator/PHP/AdminDeleteCategory.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability permits unauthorized access to the application database. This could lead to the exposure, modification, or deletion of sensitive music site data, resulting in potential service disruption and loss of data confidentiality. Given the CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized administrative actions.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the administrative interface and implement strict input validation on the affected file.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the AdminDeleteCategory.php file, specifically looking for unusual patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified administrative endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

The presence of a public proof-of-concept elevates the risk of this vulnerability to an urgent status. Organizations utilizing this software must prioritize restricting access to the administrative backend and applying robust WAF filtering to mitigate the potential for SQL injection until a vendor-supplied patch is released.