Executive brief
A vulnerability exists in the Online Music Site platform, a web application used for managing and searching music content. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or disruption of the service. This attack can be performed remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in code-projects Online Music Site 1.0 within the '/Frontend/Search.php' file. The root cause is the improper neutralization of the 'category' POST parameter before it is used in a database query. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP POST request containing malicious SQL syntax. Successful exploitation, as demonstrated by publicly available proof-of-concept code using time-based blind techniques, allows for unauthorized data retrieval, modification, or full database compromise. No patches are currently documented, but the vulnerability can be mitigated by implementing prepared statements and input validation.
Affected products
- code-projects Online Music Site 1.0
Timeline
- 2026-05-25: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-08: advisory: NVD publication date