CVE-2026-10178: SQL Injection in code-projects Online Music Site 1.0 Admin Panel

Technical summary

CVE-2026-10178 is a SQL injection vulnerability in the /Administrator/PHP/AdminEditAlbum.php file of code-projects Online Music Site 1.0. The ID argument fails to properly sanitize user input before incorporation into SQL queries, enabling classic SQL injection attacks. The vulnerability requires no authentication or user interaction (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) characterize the root causes.

Business impact

Exploited successfully, this vulnerability allows attackers to extract sensitive data from the music site's database—including user credentials, album metadata, and customer information—or modify/delete records, disrupting service. Administrative functions are directly targeted, amplifying damage scope. Public exploit availability means detection of active scanning and opportunistic attacks should be expected.

Affected systems

code-projects Online Music Site version 1.0 is confirmed affected. The vulnerability resides in the administrative interface, meaning systems running this product with accessible /Administrator/ paths are at risk. Other versions and related products require vendor confirmation; assume only v1.0 is affected unless vendor guidance indicates otherwise.

Exploitability

Exploitability is high. The attack vector is network-based, requires no authentication, no special configuration, and no user interaction. Public exploit code is available, removing the barrier to weaponization. Attackers can trivially craft malicious ID parameters to execute arbitrary SQL—for example, UNION-based injection or time-based blind SQL injection to exfiltrate data or modify database state.

Remediation

Apply security patches from the vendor as soon as they become available. If patches are unavailable or delayed, implement input validation and parameterized queries in the affected file; conduct a code review of all SQL-constructing logic in the admin module. As an immediate interim measure, restrict access to /Administrator/ paths via firewall rules or web application firewall (WAF) policies to trusted administrative networks only.

Patch guidance

Verify vendor advisories for code-projects to identify patched versions. If patches exist, prioritize deployment to all instances running v1.0. If patches are not yet released, contact the vendor for a timeline and interim mitigations. Test patches in a non-production environment before rollout to confirm admin functionality and database operations remain intact.

Detection guidance

Monitor web server and application logs for suspicious activity targeting /Administrator/PHP/AdminEditAlbum.php, particularly requests with unusual characters in the ID parameter (e.g., single quotes, SQL keywords, UNION statements, OR conditions). Database query logs may reveal execution of unexpected SQL commands. Deploy WAF rules to block common SQL injection payloads and anomalous parameter encoding targeting this endpoint.

Why prioritize this

This vulnerability merits urgent action: it affects administrative functionality, requires no authentication, permits both data exfiltration and integrity violations, carries a CVSS 3.1 score of 7.3 (HIGH), and has public exploit code available. Organizations running code-projects Online Music Site 1.0 should treat patching as critical priority.

Risk score, explained

CVSS 3.1 score of 7.3 (HIGH) reflects a network-accessible SQL injection with full confidentiality, integrity, and availability impact. The lack of authentication (PR:N) and user interaction requirements (UI:N) raises severity. Public exploit availability further elevates real-world risk independent of CVSS, accelerating timeline to compromise.

Frequently asked questions