A flaw was discovered in Online Music Site 1.0 within the file AdminUpdateAlbum.php, where the txtimage parameter can be manipulated to upload files without restriction. According to the identified weaknesses, an attacker can place arbitrary files on the server, which may lead to the execution of malicious code or other security violations. The vendor notes that remote exploitation is possible and an exploit has already been published.

The affected product is code‑projects Online Music Site version 1.0. The vulnerability resides in the AdminUpdateAlbum.php component accessible by administrators.

The CVSS score of 5.1 indicates a medium severity vulnerability. EPSS data are not available, and the issue is not listed in CISA’s KEV catalog. Remote exploitation is feasible as the upload functionality is exposed over the network, allowing an attacker to deliver malicious payloads through the unrestricted file upload. The primary attack vector is remote, given that the vulnerability originates in a web‑based admin interface without additional authentication constraints noted in the description.