A vulnerability exists in the Online Art Gallery Shop 1.0 where the query parameter "fnm" in the "/?pass=1" request can be manipulated to inject arbitrary SQL code. This flaw permits an attacker to execute unauthorized SQL statements against the underlying database, potentially exposing sensitive data, altering records, or disabling application functionality. The description notes that the attack can be launched remotely and that a public exploit is available, indicating that an external actor can target a publicly reachable instance without needing privileged access.

The flaw is limited to projectworlds Online Art Gallery Shop version 1.0, specifically the "/?pass=1" endpoint whose functionality has not been fully documented. No other product versions or vendor products are explicitly listed as affected in the available data.

The CVSS score is 6.9, reflecting moderate severity. The EPSS score is reported as less than 1%, suggesting that, at the time of this assessment, the likelihood of exploitation remains low; however, the existence of a public exploit increases concern. The vulnerability is not catalogued as a Known Exploited Vulnerability. Attackers require knowledge of the vulnerable parameter and server configuration, but remote attack assumptions mean that any exposed shop instance is a potential target. The primary risk is data compromise, with possible secondary impacts if database integrity is disrupted.