An unauthenticated SQL injection vulnerability in projectworlds Online Art Gallery Shop 1.0 poses a critical risk of full database compromise.

The application fails to properly sanitize user input in the reach_nm parameter within the /admin/adminHome.php file before using it in SQL queries. This flaw permits unauthenticated attackers to inject malicious SQL commands, leading to unauthorized database access or manipulation.

Successful exploitation allows an attacker to bypass authentication, extract sensitive data, modify database records, or potentially achieve full system control. Given the CVSS score of 7.3 and the nature of SQL injection, this vulnerability represents a significant risk to data integrity, confidentiality, and overall business continuity.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory to trusted internal IP addresses only. If the application is not business-critical, disable the service until the vendor provides a formal security update.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected use of SQL keywords or syntax errors, particularly originating from the reach_nm parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the reach_nm parameter in POST requests.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced in the CVE record.

Due to the lack of a vendor-provided patch and the availability of public proof-of-concept code, this vulnerability presents an immediate risk. Organizations utilizing this software must implement strict network-level access controls and WAF filtering to prevent unauthorized database access. Prioritize migrating away from this legacy software if the vendor does not provide timely security updates.