A SQL injection vulnerability resides in the AdminDeleteCategory.php script within the Online Music Site. The flaw arises when an attacker supplies a crafted value for the ID parameter, enabling malicious SQL statements to be executed against the database. This can lead to data exfiltration, deletion, or modification, jeopardizing confidentiality, integrity, and potentially availability of the site’s data if the attacker expands the attack to disrupt application logic.

The affected system is the code-projects Online Music Site version 1.0. The vulnerability is located in the /Administrator/PHP/AdminDeleteCategory.php file and is present in the default distribution of the site.

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. However, the attack vector is remote and publicly disclosed, meaning an attacker can exploit it without needing prior access. Because the vulnerability is not listed in the CISA KEV catalog, it is not yet identified as a known highly-exploited vulnerability, but it remains exploitable through unsanitized input in a publicly accessible administrative interface.