Code-Projects Online Music Site SQL Injection Vulnerability in login.php

A SQL injection vulnerability has been identified in Code-Projects Online Music Site version 1.0. The issue resides in the login.php file, where the application fails to properly validate or sanitize the username and password parameters. This vulnerability can be exploited remotely, allowing attackers to manipulate the login credentials and execute arbitrary SQL commands. As a result, sensitive information could be extracted from the database or potentially modified.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to the login.php file without any authentication. Include the username and password parameters. The absence of input validation on these parameters will allow for the injection of malicious SQL code.