CVE Intelligence
Analysis AI-assisted

CVE-2026-1534: Online Music Site 1.0 SQL Injection in AdminEditUser.php

A SQL injection weakness was reported in code-projects Online Music Site 1.0, in the AdminEditUser.php file, through the ID argument. The record states the attack can be started remotely and that a public exploit is available, and NVD scores it 9.8 (CVSS 3.1, critical). The record does not list the CVE in CISA KEV, and the sources consulted show no confirmed exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection weakness in the file /Administrator/PHP/AdminEditUser.php of code-projects Online Music Site 1.0. The ID argument is identified as the input that triggers the flaw, and the description states the attack can be started remotely. The CNA for this record is VulDB.

Impact

  • Inference: a successful SQL injection can allow an attacker to interfere with database queries, which may affect the confidentiality, integrity and availability of application data.
  • The NVD vector describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • The actual data exposure depends on application configuration and database privileges, which the record does not describe.

Affected products and versions

  • The description names code-projects Online Music Site 1.0.
  • The affected product field lists Fabian Online Music Site, version 1.0. The two names differ and should be reconciled by anyone reviewing this component.
  • The record lists no other affected versions.

Exploitation status

  • The description states that an exploit has been made available to the public. A GitHub issue referenced by the record carries exploit-related tags.
  • The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record contains no vendor patch or fixed version. The only fix entry is a mitigation reference to a third-party GitHub issue.
  • Review that issue for mitigation details and validate any guidance in a test environment before applying it.
  • Restrict access to administrative pages to trusted networks and accounts until the component has been reviewed.
  • Ask a developer to review the affected code path and apply parameterized queries and strict input validation on identifiers.
  • If the project is in use and no maintained fix is available, plan removal or replacement.

Detection guidance

  • Review web server and application logs for requests to the AdminEditUser.php path with unusual or malformed values in the ID parameter.
  • Watch for database error messages returned to the web application, which can indicate injection attempts.
  • Consider web application firewall alerts for SQL-related patterns on administrative endpoints, tuned to limit false positives.

Limitations of the available information

  • The record includes no vendor advisory, patched version or fix date.
  • The product name differs between the description and the affected product field.
  • EPSS and SSVC data are not available. The NVD CVSS 3.1 score is 9.8. The CNA also provided 5.5 under version 4.0, 7.3 under version 3.1 and 7.5 under version 2.0.
  • The CWE classification is CWE-74 Injection, which is broader than SQL injection.

Frequently asked questions

Is CVE-2026-1534 listed in CISA KEV?

No. The record shows the CVE is not listed in the CISA KEV catalog, and the sources consulted show no confirmed exploitation in the wild.

Is there a vendor fix for this issue?

The record lists no vendor patch or fixed version. It only includes a mitigation reference to a third-party GitHub issue, which should be reviewed and validated before use.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.