CVE-2026-10178

Vulnerability

A SQL injection vulnerability exists in code-projects Online Music Site version 1.0 within the file /Administrator/PHP/AdminEditAlbum.php. The id parameter is taken from the GET request and directly concatenated into SQL queries without proper sanitization or validation, allowing an attacker to inject malicious SQL code. No authentication is required to reach this endpoint [2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted GET request to the vulnerable script with a malicious id parameter. The exploit is publicly available and includes a proof-of-concept payload for boolean-based blind SQL injection. No prior authentication or special network position is needed; the attack can be performed remotely [2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized access to sensitive data, data tampering, complete compromise of the database server, and potential disruption of services. The attacker may gain full control over the system, posing a severe threat to confidentiality, integrity, and availability [2].

Mitigation

As of the publication date, no official patch has been released by the vendor. Users should implement input validation and use parameterized queries or prepared statements to prevent SQL injection. Additionally, restricting access to the vulnerable page or deploying a web application firewall can mitigate the risk until a fix is available [2].