An unvalidated ID parameter in AdminEditUser.php permits an attacker to inject arbitrary SQL into a backend query. This flaw can be exploited remotely over the web interface, enabling the attacker to read, modify, or delete user records and other sensitive database content. The vulnerability is categorized as CWE-74 and CWE-89, both reflecting unsanitized input usage in SQL construction. The impact extends confidentiality, integrity, and availability of the application’s user data.

The flaw exists in the code-projects Online Music Site, version 1.0, running on the /Administrator/PHP/AdminEditUser.php script. The affected function is not precisely identified beyond the ID argument handling. No other versions have been documented as vulnerable in the provided data.

The CVSS score of 6.9 assigns a medium severity to the flaw. The EPSS score of less than 1% indicates a very low probability of observed exploitation, but the vulnerability has been publicly disclosed and an exploit is available. It is not listed in the CISA KEV catalog. Attackers can trigger the injection by sending a crafted HTTP request to the administration endpoint from any machine with network access to the site.