CVE-2026-11489: code-projects Online Music Site AdminDeleteAlbum.php sql injection

Published Jun 8, 2026

Updated

A vulnerability was found in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminDeleteAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

Affected Software

1 affected component

Code-projects Online Music Site=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove code-projects Online Music Site /Administrator/PHP/AdminDeleteAlbum.php from your environment.
If the AdminDeleteAlbum.php functionality is not required, remove or disable this file from the web server to eliminate the vulnerable code.
Configuration
Modify AdminDeleteAlbum.php to stop building SQL queries with raw ID input. Validate the ID parameter (ensure it is an integer) and use parameterized/prepared statements or equivalent safe database APIs to prevent SQL injection.
code-projects Online Music Site /Administrator/PHP/AdminDeleteAlbum.php ID parameter handling = use parameterized/prepared statements; validate and sanitize ID input (e.g., enforce integer)
Compensating control
Restrict remote access to the administration interface (Administrator/PHP) to trusted IPs and/or deploy a web application firewall (WAF) with rules to detect and block SQL injection patterns until the code is fixed.

Event History

Jun 8, 2026

CVE Published

via MITRE·04:45 AM

Data Sourced

via MITRE·04:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverityWeakness

Jun 19, 58404

Event

via NVD·03:44 PM

Frequently Asked Questions

What is the severity of CVE-2026-11489?

The severity of CVE-2026-11489 is categorized as high with a score of 7.3.

What type of vulnerability is CVE-2026-11489?

CVE-2026-11489 is classified as an SQL injection vulnerability.

How do I fix CVE-2026-11489?

To fix CVE-2026-11489, ensure that all user inputs are properly validated and sanitized before being processed in SQL queries.

What software is affected by CVE-2026-11489?

CVE-2026-11489 affects the Code-projects Online Music Site version 1.0.

Can CVE-2026-11489 be exploited remotely?

Yes, CVE-2026-11489 can be exploited remotely through the AdminDeleteAlbum.php file.