A web input parameter in the file AlbumByCategory.php is not properly sanitized, allowing an attacker to inject arbitrary SQL statements through a manipulated ID argument. This SQL injection flaw can lead to unauthorized data exposure, data manipulation, or in some configurations to remote code execution if the database is compromised or misconfigured. The weakness illustrated by CWE-89 is a classic case of unsanitized user input permitting arbitrary query execution.

The vulnerability affects the code-projects Online Music Site, version 1.0. This includes the frontend component album handling script located at /Frontend/AlbumByCategory.php. No other product versions were identified as affected.

The severity score of 6.9 indicates a moderate to high risk. The EPSS score is below 1%, suggesting a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no public exploitation resources are confirmed. Attack vectors are remote, requiring only that a user supplies a crafted ID value in a request that reaches the vulnerable script. Successful exploitation would give the attacker the ability to read or alter database records associated with album listings.