Code-Projects Online Music Site SQL Injection Vulnerability in AdminViewSongs.php
Vulnerability
A SQL injection vulnerability has been identified in Code-Projects Online Music Site version 1.0. The issue resides in the file /Administrator/PHP/AdminViewSongs.php, where the 'id' parameter is manipulated, leading to unauthorized database access. This vulnerability can be exploited remotely, and the exploit has been made public.
Impact
Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.
Reproduction
To reproduce this vulnerability, send a GET request to the AdminViewSongs.php file with an 'id' parameter value that is not filtered or validated. This can be done while not logged into the frontend, which is the required condition for the vulnerability to be exploitable.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.