This vulnerability involves SQL injection in the Online Music Site 1.0 product by code-projects. Specifically, the issue exists in the /Administrator/PHP/AdminUpdateAlbum.php script where the ID parameter is not properly sanitized, allowing an attacker with high privileges to inject malicious SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity level. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the affected application. However, the vulnerability requires high privileges to exploit and has low to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, restricting access to the affected administrative interface and validating or sanitizing input parameters manually may reduce risk.