CVE Intelligence
Analysis AI-assisted

CVE-2026-0852: code-projects Online Music Site SQL injection in AdminUpdateUser.php

CVE-2026-0852 is an SQL injection flaw in code-projects Online Music Site 1.0, reached through the ID argument of /Administrator/PHP/AdminUpdateUser.php. The record states it can be exploited remotely, NVD rates it critical at 9.8, and a public exploit has been released. No fixed version is listed in the record.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

A SQL injection flaw, classified as CWE-74 (Injection) in the record, affects code-projects Online Music Site 1.0. The problem sits in an unidentified function of /Administrator/PHP/AdminUpdateUser.php, where the ID argument is not handled safely. The record states the issue can be triggered remotely.

Impact

  • NVD assigns a CVSS score of 9.8 (critical), which reflects high confidentiality, integrity and availability impact under its vector.
  • Other scores in the record are lower, including 7.3 and 5.5 from different providers, so the severity depends on the scoring source used.
  • The SSVC data in the record rates technical impact as partial.

Affected products and versions

  • Code-projects Online Music Site, version 1.0.
  • Fabian Online Music Site, version 1.0, also listed in the record.
  • The record lists no fixed version.

Exploitation status

The record states that an exploit has been released to the public. The CISA KEV catalog does not list this CVE in the data consulted, so no confirmed active exploitation in the wild is stated here. A GitHub issue tagged as an exploit appears among the references; its contents are not reproduced in this analysis.

Remediation and mitigation

  • Identify whether any deployment of this application exists and whether it is still needed.
  • Restrict access to administrative paths to trusted networks and accounts while the issue is unresolved.
  • The record documents no vendor patch; treat the fix status as unknown and confirm it with the maintainer or the vendor listed at code-projects.org.
  • Over the longer term, parameterized queries and strict input validation on identifier parameters address this class of flaw.
  • Disable or remove the application if it is not in active use.

Detection guidance

  • Review web server and application logs for requests to the administrative user-management script that carry unusual characters or abnormal values in the ID parameter.
  • Watch for database errors that appear in responses from administrative pages, as these can indicate injection attempts.

Limitations of the available information

  • The record does not name the vulnerable function or the exact line of code.
  • No fixed version, patch or vendor advisory is listed.
  • It is unknown whether the product is still maintained.
  • The sources disagree on severity, so the scores should be read in context.

Frequently asked questions

Can this SQL injection be exploited remotely?

The record states the attack can be executed remotely. It also notes that a public exploit has been released, so exposed instances carry elevated risk.

Is there a confirmed fix for CVE-2026-0852?

The record lists no fixed version or patch. The fix status is unknown, so confirm with the maintainer or vendor and restrict access to the administrative area in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.