CVE-2026-10178: code-projects Online Music Site AdminEditAlbum.php sql injection
A vulnerability was detected in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminEditAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Online Music Site (/Administrator/PHP/AdminEditAlbum.php)from your environment.If the AdminEditAlbum.php functionality is not required, remove or disable /Administrator/PHP/AdminEditAlbum.php from the webroot to eliminate the vulnerable code path.
- Configuration
Modify /Administrator/PHP/AdminEditAlbum.php to stop interpolating the ID argument into SQL. Validate the ID input (e.g., cast/check as integer) and use prepared statements/parameterized queries or proper escaping for all database access to eliminate SQL injection.
code-projects Online Music Site (/Administrator/PHP/AdminEditAlbum.php) ID parameter handling = validate and sanitize; enforce integer type or use parameterized queries - Compensating control
Restrict remote access to the administration interface (e.g., firewall rules, VPN, IP allowlist) and deploy a web application firewall or intrusion prevention that blocks SQL injection attempts against the AdminEditAlbum.php endpoint until code-level fixes are applied.
- Operational
Because a public exploit exists, review access and application logs for suspicious requests to /Administrator/PHP/AdminEditAlbum.php and related endpoints, and, if compromise is suspected, rotate any credentials that may have been exposed and follow incident response procedures.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10178?
CVE-2026-10178 has a severity rating of 7.3, classified as high.
How do I fix CVE-2026-10178?
To fix CVE-2026-10178, sanitize input data and use prepared statements to prevent SQL injection.
What type of vulnerability is CVE-2026-10178?
CVE-2026-10178 is a SQL Injection vulnerability.
Can CVE-2026-10178 be exploited remotely?
Yes, CVE-2026-10178 can be exploited remotely.
What software is affected by CVE-2026-10178?
CVE-2026-10178 affects Code-projects Online Music Site version 1.0.