SourceCodester Simple Music Cloud Community System version 1.0 contains an SQL injection flaw in the /music/view_user.php script. Unsanitized user input is directly incorporated into database queries, allowing an attacker to inject arbitrary SQL statements that can read, modify, or delete application data. This vulnerability is a classic example of CWE‑89, giving potential attackers control over the database content and leading to confidentiality and integrity violations. The likely attack vector is via HTTP requests to the vulnerable endpoint, inferred from the nature of the web application and the lack of any authentication mention in the description.

The affected product is SourceCodester Simple Music Cloud Community System, version 1.0. No other vendors or product versions are listed as impacted.

With a CVSS score of 9.4 the flaw is classified as critical, reflecting severe potential impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly documented exploits are not yet known. However, an attacker who can reach the web application can construct malicious requests that exploit the injection point, leveraging the privileges of the application’s database account. The risk remains high due to the possibility of extensive data exposure or manipulation if the application is publicly reachable or if credentials are shared among users.