A flaw in the Online Music Site 1.0 occurs in the AdminDeleteUser.php script when the ID argument is manipulated, allowing SQL injection. This vulnerability can be exploited remotely by an attacker who can construct a crafted request that injects arbitrary SQL into the database. The result is potential unauthorized modification or deletion of user data, compromising data integrity and possibly granting the attacker further privileges if additional vulnerabilities exist.

The vulnerability affects the code-projects Online Music Site version 1.0. Management interfaces located at /Administrator/PHP/AdminDeleteUser.php are impacted. No other products or versions were listed.

The CVSS v3.0 score is 6.9, indicating a high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exercise the flaw remotely by sending a crafted HTTP request to the deletion endpoint. The exploit path requires access to the administrative interface, but the injection occurs in code that is exposed to web requests, which increases the attack surface for brunt or credential‑guessing approaches.