The vulnerability is a SQL injection flaw in the adminHome.php page of the Online Art Gallery Shop application. The flaw allows an attacker to manipulate the ‘Info’ argument used in database queries, enabling the injection of arbitrary SQL statements. Because the flaw can be triggered remotely, an attacker may read, modify, or delete database contents. The CVE description does not specify whether authentication is required; based on the description, it is inferred that authentication may not be needed, but this is not explicitly stated. This weakness is categorized as CWE-74 and CWE-89.

The affected product is projectworlds Online Art Gallery Shop version 1.0. This software includes the adminHome.php script that is vulnerable to the described SQL injection. No other versions or components are known to be impacted based on the current disclosure.

The CVSS score is 6.9, indicating a medium severity vulnerability. The EPSS score is less than 1 %, suggesting a low current probability of exploitation, but the existence of public exploit code means the risk remains non‑trivial. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a crafted request to the /admin/adminHome.php page with a malicious ‘Info’ parameter. It is not explicitly stated whether authentication is required; based on the description, the flaw can be triggered remotely, suggesting that authentication may not be necessary, but this is inferred. Because the vulnerability allows injection of raw SQL, the potential impact ranges from data disclosure to full compromise of the underlying database.