CVE-2026-10178 Overview
CVE-2026-10178 is a SQL injection vulnerability in code-projects Online Music Site 1.0. The flaw exists in /Administrator/PHP/AdminEditAlbum.php, where the ID parameter is passed to a backend database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public exploit details have been disclosed through VulDB and GitHub references, increasing exposure for unpatched deployments.
Critical Impact
Unauthenticated remote attackers can inject SQL via the ID parameter of AdminEditAlbum.php, potentially exposing or modifying administrator-managed album data in the underlying database.
Affected Products
- code-projects Online Music Site 1.0
- Component: /Administrator/PHP/AdminEditAlbum.php
- Vulnerable parameter: ID
Discovery Timeline
- 2026-05-31 - CVE-2026-10178 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10178
Vulnerability Analysis
The vulnerability resides in the administrative album editing script /Administrator/PHP/AdminEditAlbum.php. The script accepts an ID parameter that is incorporated directly into a SQL query without parameterization or input validation. An attacker supplies crafted SQL syntax in place of the expected numeric identifier, altering the structure of the executed query.
Because the attack vector is network-based and requires no authentication or user interaction, exploitation can be automated. According to the EPSS data (0.033%, 10.197 percentile), broad opportunistic exploitation appears unlikely at present, but the public availability of exploit details elevates targeted risk for exposed instances.
Root Cause
The root cause is improper neutralization of user-supplied input before its inclusion in a SQL statement [CWE-74]. The AdminEditAlbum.php endpoint concatenates the ID value into a query string rather than using prepared statements or parameter binding. No allowlist filtering, type casting, or escaping is performed on the ID argument.
Attack Vector
An attacker submits an HTTP request to /Administrator/PHP/AdminEditAlbum.php with a malicious ID parameter. Typical payloads use UNION-based, boolean-based, or time-based blind SQL injection techniques to enumerate database schema, extract records, or modify rows. Because the affected endpoint resides in the Administrator directory, successful exploitation can disclose or tamper with administrator-managed content. Technical reproduction notes are referenced in the public GitHub CVE Issue Discussion and VulDB CVE-2026-10178 entries.
Detection Methods for CVE-2026-10178
Indicators of Compromise
- HTTP requests to /Administrator/PHP/AdminEditAlbum.php containing SQL metacharacters such as ', ", --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
- Unexpected database errors logged by PHP or the MySQL/MariaDB backend referencing the AdminEditAlbum.php script.
- Anomalous outbound data volumes from the web application server following requests to the administrator path.
Detection Strategies
- Deploy web application firewall (WAF) rules to inspect the ID parameter on the affected URL for SQL injection signatures.
- Enable database query logging and alert on queries originating from AdminEditAlbum.php that contain UNION SELECT, INFORMATION_SCHEMA, or stacked statements.
- Review access logs for repeated requests to the affected endpoint with varying ID values, indicative of blind SQL injection enumeration.
Monitoring Recommendations
- Forward web server, PHP error, and database logs to a centralized analytics platform for correlation across the application stack.
- Baseline normal administrator activity and alert on access to /Administrator/PHP/ from unexpected source IPs or outside business hours.
- Monitor for newly created or modified database accounts, since SQL injection is frequently used to establish persistence.
How to Mitigate CVE-2026-10178
Immediate Actions Required
- Restrict network access to the /Administrator/ directory using IP allowlisting, VPN, or HTTP authentication until a code-level fix is applied.
- Disable or remove the AdminEditAlbum.php endpoint if the album editing functionality is not required.
- Rotate database credentials and review database audit logs for evidence of prior exploitation.
Patch Information
No vendor patch has been published in the referenced advisories at the time of NVD publication. Administrators should consult the Code Projects Resource Hub and the VulDB Vulnerability #367459 entry for any future fix updates. In the absence of an upstream patch, application owners should modify AdminEditAlbum.php to use parameterized queries (mysqli prepared statements or PDO with bound parameters) and cast ID to an integer before use.
Workarounds
- Apply server-side input validation that enforces a strict integer type for the ID parameter and rejects all other input.
- Deploy WAF signatures that block common SQL injection patterns targeting the ID parameter on AdminEditAlbum.php.
- Apply least-privilege database accounts so that the web application cannot execute administrative SQL statements such as DROP, GRANT, or access to mysql.* tables.
# Example ModSecurity rule to block SQLi attempts against the affected endpoint
SecRule REQUEST_URI "@contains /Administrator/PHP/AdminEditAlbum.php" \
"phase:2,chain,deny,status:403,id:1026010178,msg:'CVE-2026-10178 SQLi attempt'"
SecRule ARGS:ID "@detectSQLi" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
