A critical SQL injection vulnerability in the projectworlds Online Art Gallery Shop allows unauthenticated attackers to potentially compromise database integrity and access sensitive data.

The application fails to properly sanitize user input in the fnm parameter within the /?pass=1 file. This SQL injection flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database operations.

Successful exploitation of this vulnerability can result in the full disclosure of sensitive database contents, unauthorized data modification, or total loss of data integrity. Given the CVSS score of 7.3, this represents a high-risk scenario where an attacker can gain significant control over the backend database without requiring any authentication, potentially leading to service disruption and severe reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected file or disable the vulnerable functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at the /?pass=1 endpoint, specifically looking for SQL syntax patterns or unexpected character strings in the fnm parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block common SQL injection payloads targeted at the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a publicly available proof-of-concept significantly increases the risk of exploitation by automated scanners and malicious actors. Organizations running this software must prioritize the implementation of compensating controls, such as WAF filtering, and actively seek a secure alternative or vendor-provided fix to remediate the underlying code flaw.