Description
A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-01-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Database Compromise via SQL Injection
Action: Apply Patch
AI Analysis

Impact

The flaw allows an attacker to inject arbitrary SQL statements by manipulating the ID argument in the AdminUpdateUser.php file. This can lead to unauthorized reading, alteration, or deletion of database records and may be used to elevate privileges within the application, compromising the confidentiality and integrity of the stored music data.

Affected Systems

The vulnerability affects the code-projects Online Music Site version 1.0. No other vendors or product versions are listed.

Risk and Exploitability

With a CVSS score of 6.9 the weakness is considered moderate to high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. However, the public release of an exploit and remote execution capability means an attacker can reach the vulnerable component over the network and exploit the injection without authentication.

Generated by OpenCVE AI on April 18, 2026 at 07:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the Online Music Site that includes the fix for the AdminUpdateUser.php SQL injection.
  • Restrict external access to the Administrator directory, allowing only trusted internal hosts to manage users.
  • Sanitize the ID parameter and refactor the database queries to use parameterized statements or prepared statements.
  • Apply the suggested workaround by modifying the input handling to reject unexpected characters or patterns before constructing SQL statements.

Generated by OpenCVE AI on April 18, 2026 at 07:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Jan 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Music Site
CPEs cpe:2.3:a:fabian:online_music_site:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Music Site

Mon, 12 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Music Site
Vendors & Products Code-projects
Code-projects online Music Site

Mon, 12 Jan 2026 00:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title code-projects Online Music Site AdminUpdateUser.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Music Site
Fabian Online Music Site
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:31:40.492Z

Reserved: 2026-01-11T09:11:00.474Z

Link: CVE-2026-0852

cve-icon Vulnrichment

Updated: 2026-01-12T15:55:10.585Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-12T01:15:49.950

Modified: 2026-01-14T22:19:33.933

Link: CVE-2026-0852

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T07:15:25Z

Weaknesses