EUVD-2026-23253
GHSA-263f-2q4p-95qq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.
AnalysisAI
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the /music/view_genre.php endpoint, enabling complete database compromise including data theft, modification, and potential server takeover. CVSS 9.8 (Critical) with network-exploitable attack vector requiring no authentication or user interaction. EPSS score of 0.01% (2nd percentile) indicates low observed exploitation probability despite critical severity. Publicly available proof-of-concept exists (GitHub repository), lowering exploitation barrier for opportunistic attackers.
Technical ContextAI
SQL injection (CWE-89) is a code injection vulnerability occurring when user-supplied input is improperly sanitized before being incorporated into SQL queries. In this case, the Simple Music Cloud Community System v1.0-a PHP-based web application for music sharing/streaming-fails to validate or parameterize inputs to the view_genre.php script. The vulnerability allows attackers to manipulate SQL query structure, breaking out of intended query logic to execute arbitrary database commands. PHP applications are particularly susceptible when using legacy mysql_* functions or concatenating user input directly into queries instead of prepared statements with bound parameters. The affected system likely uses MySQL/MariaDB as the backend database given the PHP stack, though specific CPE data is not available in NVD records.
RemediationAI
Primary remediation requires migrating to a patched version if available or implementing code-level fixes, though no vendor-released patch has been identified at time of analysis. Organizations using this system should immediately apply compensating controls: implement web application firewall (WAF) rules to block SQL injection patterns in requests to /music/view_genre.php (monitor for evasion attempts using encoding/obfuscation); restrict database account privileges used by the application to minimum required operations (read-only where possible, never GRANT or FILE permissions); deploy network segmentation to prevent database server access from web tier except required ports; enable database query logging to detect exploitation attempts. Long-term mitigation: refactor view_genre.php to use parameterized queries (PDO prepared statements in PHP) instead of string concatenation-developers should review https://github.com/mt-0505/cve-report/blob/main/sourcecodester/simple-music-cloud-community-system/SQL-3.md for specific vulnerable code patterns. If the application is not business-critical, consider decommissioning given the apparent lack of active maintenance. WAF rules may impact legitimate traffic if genre parameters use special characters; test thoroughly in staging environments.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today