Executive brief
A vulnerability exists in the Online Music Site platform, a web application used for managing music content. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of site data. This could result in a full system takeover or disruption of the music service.
Technical details
A SQL injection vulnerability exists in code-projects Online Music Site 1.0 within the /Administrator/PHP/AdminEditAlbum.php component. The root cause is the failure to sanitize or validate the 'id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests (supporting boolean-based, time-based, and UNION-based injection techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential administrative bypass. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Online Music Site 1.0
Timeline
- 2026-05-06: disclosed: Initial disclosure on GitHub by gtxy114514
- 2026-05-31: advisory: NVD and VulDB publication date