CVE-2026-10171: SQL Injection in code-projects Online Music Site 1.0 AdminUpdateAlbum.php

Technical summary

CVE-2026-10171 is a SQL injection flaw (CWE-89) stemming from improper input validation (CWE-74) in the AdminUpdateAlbum.php component of code-projects Online Music Site 1.0. The ID parameter is processed without adequate parameterization or escaping before being incorporated into SQL queries. The attack surface is remotely accessible but requires high-level privileges (administrator role), as indicated by the CVSS vector. The vulnerability received a CVSS 3.1 score of 4.7 (MEDIUM severity) reflecting the constraint that legitimate administrative access is a prerequisite.

Business impact

While administrative privileges are required to exploit this vulnerability, compromise of an admin account—whether through credential theft, session hijacking, or insider threat—creates a direct path to database manipulation. Exploitation could lead to unauthorized data modification, deletion of music catalogs or user records, and potential exposure of sensitive information stored in the database. For organizations running this legacy software, the public disclosure and availability of working exploits significantly elevate the risk window between discovery and patching.

Affected systems

This vulnerability affects code-projects Online Music Site version 1.0. Organizations using this application should audit their deployment inventory immediately. The vulnerability is specific to this product and version; other Online Music Site versions or competing music management platforms are not affected by this particular issue unless they share identical code patterns.

Exploitability

The vulnerability is remotely exploitable but constrained by the requirement for valid administrator credentials. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U) indicates low attack complexity once authenticated, meaning no special setup or user interaction is needed beyond admin login. Public disclosure and available exploit code lower the barrier to weaponization significantly. The primary exploitability concern is compromise of administrative accounts through phishing, weak password practices, or lateral movement within compromised networks.

Remediation

Upgrade code-projects Online Music Site to a patched version released after June 17, 2026 (the last modification date of this CVE record). Verify the specific patch version against the vendor's security advisory. Until patching is feasible, implement network-level access controls to restrict administrative interfaces to trusted IP ranges, enforce multi-factor authentication for admin accounts, and maintain detailed audit logs of administrative actions. Consider disabling the album update functionality if not actively used.

Patch guidance

Contact code-projects for an official security update addressing SQL injection in AdminUpdateAlbum.php—verify the patch details and version number against the vendor advisory before deployment. Test patches in a staging environment before production rollout. If the vendor has not released a patch, consult their security documentation for interim mitigations or workarounds. Given the public disclosure status, prioritize patching over typical change windows if operational risk permits.

Detection guidance

Monitor access logs to /Administrator/PHP/AdminUpdateAlbum.php for suspicious ID parameter values containing SQL keywords (UNION, SELECT, DROP, etc.) or special characters (quotes, semicolons, comments). Implement database activity monitoring (DAM) to detect unusual query patterns or privilege escalation attempts originating from admin accounts. Alert on any album update operations initiated outside business hours or by unexpected users. Review admin session logs for anomalous login times or geographic inconsistencies.

Why prioritize this

Although the CVSS score is MEDIUM (4.7), prioritization depends on your environment. If you run code-projects Online Music Site 1.0 with internet-facing admin interfaces or weak credential hygiene, treat this as HIGH priority because public exploits eliminate the need for sophisticated attack techniques. If the admin panel is air-gapped or strictly access-controlled, it remains MEDIUM. The public disclosure and available exploit code justify moving this above routine patch cycles.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects a MEDIUM severity rating because exploitation requires high-privilege (PR:H) authenticated access, limiting the attack surface to compromised admin accounts rather than unauthenticated network actors. However, the score does not account for the reputational and operational impact of database manipulation, nor does it reduce for public exploit availability—factors that should influence your internal risk prioritization logic. Organizations with weak admin account security should weight this higher than the base score suggests.

Frequently asked questions