CVE-2026-10171
Description
SQL injection in code-projects Online Music Site 1.0 AdminUpdateAlbum.php allows remote attackers to execute arbitrary SQL commands via the ID parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection in code-projects Online Music Site 1.0 AdminUpdateAlbum.php allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Vulnerability
A SQL injection vulnerability exists in the AdminUpdateAlbum.php file of code-projects Online Music Site version 1.0. The id parameter is directly concatenated into SQL queries without sanitization, allowing injection of malicious SQL statements. The vulnerable endpoint is located at /Administrator/PHP/AdminUpdateAlbum.php. [1]
Exploitation
The attack can be launched remotely without authentication. An attacker sends a crafted POST request with a malicious id parameter. The reference includes a proof-of-concept payload using boolean-based blind SQL injection via MySQL RLIKE. No special privileges or user interaction are required. [1]
Impact
Successful exploitation allows an attacker to gain unauthorized access to the database, leading to sensitive data leakage, data tampering, and potential full system compromise. The attacker can manipulate SQL queries to extract, modify, or delete data, and may escalate to control over the application and underlying server. [1]
Mitigation
As of the publication date (2026-05-31), no official patch has been released by code-projects. The vendor homepage is at code-projects.org [2]. Users should apply input validation and parameterized queries to the id parameter in AdminUpdateAlbum.php. Until a fix is available, restrict network access to the administrative interface and monitor for suspicious requests.
AI Insight generated on May 31, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input sanitization on the "id" parameter in AdminUpdateAlbum.php allows direct injection of SQL code into database queries."
Attack vector
An attacker sends a crafted POST request to /Administrator/PHP/AdminUpdateAlbum.php with a malicious "id" parameter [ref_id=1]. The parameter is directly concatenated into SQL queries without sanitization, enabling boolean-based blind, error-based, and time-based SQL injection [ref_id=1]. The attack is remotely exploitable over HTTP with no authentication required [ref_id=1]. The researcher demonstrated payloads such as `95' RLIKE (SELECT (CASE WHEN (5543=5543) THEN 0x39355e ELSE 0x28 END))-- gPRX` to manipulate the query logic [ref_id=1].
Affected code
The vulnerable file is /Administrator/PHP/AdminUpdateAlbum.php in the code-projects Online Music Site version 1.0 [ref_id=1]. The "id" POST parameter is the injection point; it is used directly in SQL queries without sanitization [ref_id=1].
What the fix does
No official patch has been published by the vendor. The researcher recommends using prepared statements with parameter binding to segregate SQL code from user input, rigorous input validation and filtering to block malicious data, and minimizing database user permissions to limit the blast radius of any successful injection [ref_id=1].
Preconditions
- networkAttacker must be able to send HTTP POST requests to the vulnerable endpoint
- authNo authentication or login is required
Reproduction
1. Send a POST request to `http://localhost/mis/Administrator/PHP/AdminUpdateAlbum.php` with a `Content-Type: multipart/form-data` body. 2. Include the parameter `id` with a SQL injection payload, e.g., `95' AND (SELECT 4310 FROM (SELECT(SLEEP(5)))jeEg)-- HeOF`. 3. Observe a 5-second delay in the response, confirming time-based blind SQL injection [ref_id=1]. The full request packet and sqlmap command are provided in the researcher's write-up [ref_id=1].
Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
1- Code-Projects Batch: Four SQLi Bugs Across Three Products Disclosed TogetherVypr Intelligence · May 31, 2026