A weakness in the AdminUpdateCategory.php script of code-projects Online Music Site 1.0 allows an attacker to supply an arbitrary file through the txtimage argument. The import of the file is performed without validating its type or size, giving the attacker the ability to upload executable code such as PHP scripts. If the uploaded file is placed in a web-accessible directory, the attacker can then execute arbitrary commands on the server, compromising confidentiality, integrity, and availability.

The vulnerability affects instances of code-projects Online Music Site version 1.0, specifically the administrator page located at /Administrator/PHP/AdminUpdateCategory.php. Users running this software without a security update are at risk.

With a CVSS score of 6.9, the issue represents medium severity. The EPSS shows a probability of exploitation of less than 1 percent, yet public exploitation code has been discovered and is available, indicating that the window for attacks is open. Allowing unrestricted file uploads is a remote attack vector that can be triggered by an unauthenticated or minimally privileged user if administrative access is not properly restricted, potentially leading to remote code execution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.