The vulnerability is a remote SQL injection in the txtcat parameter of AdminUpdateCategory.php in code‑projects Online Music Site 1.0. The flaw permits an attacker to inject arbitrary SQL statements, potentially reading, modifying, or deleting data in the database. Because the affected page runs with administrative privileges, the impact could include full compromise of the site’s content and user data, as well as elevation of privileges. The weakness corresponds to CWE‑89 and can be accessed via unsanitized input injected as SQL.

code‑projects Online Music Site, version 1.0.

The CVSS score is 6.9, indicating medium severity, while the EPSS score is below 1 %, suggesting a low exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog. According to the description, the attack can be executed remotely by sending a crafted request to the /Administrator/PHP/AdminUpdateCategory.php endpoint, manipulating the txtcat parameter to inject malicious SQL. Publicly available exploits have been released, which raises the risk for any operational instance that has not yet been patched or mitigated.