A vulnerable function in the /admin/registration.php file of projectworlds Online Art Gallery Shop allows an attacker to inject arbitrary SQL through manipulation of the fname parameter. The flaw permits remote exploitation, potentially giving an attacker access to or modification of the underlying database. This is a classic input validation weakness classified under CWE-89 (SQL Injection) and also involves improper handling of file input identified as CWE-74. The publicly available exploit documented in the community enables attackers to launch attacks without custom code.

The affected product is projectworlds Online Art Gallery Shop version 1.0. No other versions are explicitly listed as vulnerable. The vulnerability is present in the Registration Handler component's admin registration endpoint.

The CVSS score of 6.9 indicates medium severity, while the EPSS score below 1% suggests a low likelihood of observed exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers could remotely submit a crafted fname value to the registration endpoint, exploiting the injection flaw to read or alter data. The public availability of an exploit increases the risk, even though the EPSS suggests low exploitation frequency.