Description
A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-01-28
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Patch
AI Analysis

Impact

The vulnerability is a classic SQL injection in the AdminReply.php script of the Online Music Site, where the ID argument is not properly sanitised. This weakness corresponds to CWE‑74 and CWE‑89. An attacker who can supply a crafted ID may execute arbitrary SQL statements against the database, thereby compromising both confidentiality and integrity of the stored data.

Affected Systems

code-projects Online Music Site version 1.0 is affected, specifically the Administrator/PHP/AdminReply.php module of this web application.

Risk and Exploitability

The CVSS score of 6.9 classifies the vulnerability as medium severity, while the EPSS rate of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be remote, i.e. through a web request to the AdminReply.php page with a crafted ID parameter. The absence of input filtering allows the attacker to inject SQL immediately, making exploitation straightforward for anyone who can reach the page.

Generated by OpenCVE AI on April 18, 2026 at 14:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or upgrade to a version where the issue is fixed.
  • Restrict access to /Administrator/PHP/AdminReply.php to authenticated administrators using web‑server or application‑level access controls.
  • Validate the ID parameter using prepared statements or sanitise it, rejecting non‑numeric input when a patch is not available.

Generated by OpenCVE AI on April 18, 2026 at 14:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Music Site
CPEs cpe:2.3:a:fabian:online_music_site:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Music Site

Thu, 29 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Music Site
Vendors & Products Code-projects
Code-projects online Music Site

Wed, 28 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title code-projects Online Music Site AdminReply.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Music Site
Fabian Online Music Site
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:01:24.768Z

Reserved: 2026-01-28T13:41:07.385Z

Link: CVE-2026-1535

cve-icon Vulnrichment

Updated: 2026-01-28T21:29:15.837Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-28T21:16:11.333

Modified: 2026-02-02T21:00:18.237

Link: CVE-2026-1535

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T14:45:03Z

Weaknesses