CVE-2026-0607: code-projects Online Music Site SQL injection in AdminViewSongs.php
A SQL injection flaw (CWE-89) has been reported in code-projects Online Music Site 1.0, in the file /Administrator/PHP/AdminViewSongs.php, through the ID argument. The record states the issue can be triggered remotely and that a public exploit has been published. No fixed version is listed in the available sources.
Overview
CVE-2026-0607 affects code-projects Online Music Site 1.0. The record places the flaw in the file /Administrator/PHP/AdminViewSongs.php and links it to SQL injection through manipulation of the ID argument, classified as CWE-89. The source record describes the issue as remotely triggerable.
Impact
- SQL injection can allow an attacker to influence database queries. The actual consequences depend on the database permissions and the application configuration, which the sources do not describe (inference).
- NVD assigns a CVSS base score of 9.8 (critical), and its vector marks confidentiality, integrity and availability as high. Scores from other providers in the record range from 5.5 to 7.5.
Affected products and versions
- Code-projects Online Music Site, version 1.0.
- Fabian Online Music Site, version 1.0, is also listed in the record.
- The sources do not identify any other affected versions.
Exploitation status
The record does not list CVE-2026-0607 in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The description states that an exploit has been published and may be used, and the references include third-party write-ups tagged as exploit material.
Remediation and mitigation
- The record lists no fixed version. Whether the vendor or project has released a fix is unknown.
- Restrict access to the administrative area of the application to trusted networks and accounts.
- If no fix is available, consider taking the affected application offline or isolating it until the input handling is reviewed.
- Review how the ID parameter is handled and ensure database queries use parameterized statements.
Detection guidance
- Review web server and application logs for requests to AdminViewSongs.php with unexpected or malformed values in the ID parameter.
- Monitor database error messages that originate from this endpoint, as they may indicate input reaching queries unsafely.
- Alert on unusual volumes of requests to administrative pages from external addresses.
Limitations of the available information
The record provides no fixed version, no vendor advisory detail and no version range beyond 1.0. The sources do not confirm exploitation. CVSS scores differ between providers, and the affected component is described only as an unknown part of the file.
Frequently asked questions
Is CVE-2026-0607 being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The description says a public exploit has been published and may be used.
Which versions are affected?
The record lists code-projects Online Music Site version 1.0 and Fabian Online Music Site version 1.0. No other versions are identified in the sources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.