CVE-2026-1533: code-projects Online Music Site 1.0 - SQL Injection in AdminAddCategory.php
A SQL injection flaw (CWE-89) in code-projects Online Music Site 1.0 affects an unknown function in /Administrator/PHP/AdminAddCategory.php and can be triggered remotely. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that a public exploit has been released. No fixed version is listed, and the record is not listed in CISA KEV.
Overview
The record describes an SQL injection flaw (CWE-89) in code-projects Online Music Site 1.0. The affected element is an unknown function within /Administrator/PHP/AdminAddCategory.php, according to the VulDB-based description. The flaw can be triggered remotely, and the record states that an exploit has been publicly released.
Impact
SQL injection can allow an attacker to interact with the database behind an application, potentially reading, modifying or deleting data depending on the configuration and privileges in place. NVD scores the issue 9.8 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. CNA-provided scores are lower, including 4.7 under CVSS 3.1, 5.8 under CVSS 2.0 and 2 under CVSS 4.0, so local severity should be verified against the actual deployment.
Affected products and versions
- Product named in the description: code-projects Online Music Site 1.0.
- Product named in the affected field: Fabian Online Music Site, version 1.0.
The two product names differ, so administrators should confirm which codebase they run. The record lists no other affected versions.
Exploitation status
The record is not listed in CISA KEV, so this analysis does not state active exploitation. The description says the exploit has been released to the public and may be used for attacks, and a GitHub issue is tagged as an exploit reference. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- No fixed version is listed in the record. The only fix-related entry is a mitigation reference in a third-party GitHub issue.
- Restrict access to the administrative directory to trusted networks until the code has been reviewed.
- Review how AdminAddCategory.php handles input and replace string-built SQL queries with parameterized queries or prepared statements.
- Remove or disable the application if it is not needed, and assess whether the upstream code is still maintained before reusing it.
Detection guidance
- Review web server and application logs for unusual requests to the administrative category endpoint, especially with malformed or unexpected parameters.
- Monitor database error messages and unexpected query patterns originating from the web application account.
- Use web application firewall alerts where available, bearing in mind that filtering is not a substitute for fixing the code.
Limitations of the available information
The record does not identify the vulnerable parameter, a fixed release, a vendor advisory, or EPSS data. CVSS and CNA scores differ, and the product name in the description does not match the affected product field. Vendor and version details should be verified before relying on them.
Frequently asked questions
Is CVE-2026-1533 being actively exploited?
The record is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted. The description does state that a public exploit has been released, so the risk of opportunistic use should be treated seriously.
Is there a fixed version available?
The record does not list a fixed version. It only includes a mitigation reference in a third-party GitHub issue, so administrators should restrict access and review the code.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.