CVE-2023-0961
Published: 22 February 2023
Summary
CVE-2023-0961 is a medium-severity SQL Injection (CWE-89) vulnerability in Music Gallery Site Project Music Gallery Site. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 40.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-0961 is a SQL injection vulnerability in SourceCodester Music Gallery Site version 1.0. It resides in an unknown portion of the file view_music_details.php within the GET Request Handler component, where unsanitized manipulation of the id argument allows injection of arbitrary SQL statements.
An authenticated remote attacker can supply a crafted GET request to the affected endpoint and obtain limited read, write, and disruption capabilities against the underlying database. The CVSS 6.3 vector reflects network attack reach, low attack complexity, and low-privileged access without user interaction.
Public proof-of-concept code demonstrating the injection was released shortly after disclosure. The associated EPSS score rose materially from a low baseline after publication, reaching a peak of 0.0802 on 2025-01-22 before receding to the current value of 0.0038, indicating a later surge in exploitation interest that has since subsided.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12946
Vulnerability details
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql…
more
injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221631.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.