A remote attacker can exploit a flaw in the adminHome.php script of projectworlds Online Art Gallery Shop 1.0 by manipulating the reach_nm argument, which bypasses input validation and allows arbitrary SQL code to be executed against the underlying database. This SQL injection can compromise data confidentiality, integrity, and availability by enabling attackers to read, modify, or delete sensitive information stored in the shop database.

The vulnerability affects the projectworlds Online Art Gallery Shop, specifically version 1.0 as identified in the CPE entries. Any deployment of this version that exposes the admin panel to the Internet is potentially susceptible.

The CVSS score of 6.9 reflects a medium severity risk and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time, though the vulnerability remains publicly disclosed and could be leveraged. The lack of a KEV listing suggests no confirmed exploitation yet, but the remote nature of the attack vector and absence of mitigated input handling warrant immediate attention. Attackers could perform the exploit by supplying crafted values to the reach_nm parameter in an HTTP request directed at adminHome.php.