CVE-2026-10875: SQL Injection in projectworlds Online Art Gallery Shop Admin Panel

Technical summary

The vulnerability resides in an unspecified function within /admin/adminHome.php of projectworlds Online Art Gallery Shop Project 1.0. The social_twitter parameter fails to properly sanitize user input before incorporating it into SQL queries, enabling SQL injection attacks (CWE-89). The flaw is classified as Improper Neutralization of Special Elements used in an SQL Command (CWE-74). The CVSS v3.1 score of 6.3 reflects a network-exploitable, low-complexity attack requiring valid authentication that can compromise confidentiality, integrity, and availability of database contents.

Business impact

This vulnerability could allow an attacker with administrative credentials—or who has compromised such credentials—to exfiltrate sensitive data stored in the gallery database, including user information, transaction records, and media metadata. Attackers could also modify or delete records, leading to data corruption, service disruption, and loss of customer trust. For organizations running this gallery platform, the combination of authentication requirement and publicly disclosed exploits creates a heightened risk window.

Affected systems

projectworlds Online Art Gallery Shop Project version 1.0 is affected. Organizations using this specific project should verify their deployment versions. If you maintain custom forks or modified versions of this software, assess whether your codebase contains the vulnerable code pattern in the admin panel's handling of social media parameters.

Exploitability

The vulnerability requires valid admin credentials to exploit, which reduces the attack surface compared to an unauthenticated flaw. However, the public release of exploit code and the straightforward nature of SQL injection attacks mean that any threat actor with compromised or default credentials can readily weaponize this flaw. Remote exploitation is possible over the network without user interaction, so compromised admin accounts pose immediate risk.

Remediation

Organizations using projectworlds Online Art Gallery Shop Project 1.0 should: (1) immediately change all admin account passwords and enable strong authentication controls; (2) review admin access logs for any suspicious database queries or data access patterns; (3) verify whether a patched version is available from the projectworlds team; (4) if no patch exists, apply input validation and parameterized queries to the /admin/adminHome.php file's handling of the social_twitter parameter; (5) consider isolating the admin panel behind additional network controls or a Web Application Firewall (WAF) with SQL injection detection rules.

Patch guidance

Check the projectworlds project repository or official support channels for a patched version addressing this SQL injection flaw. Verify patch availability against the vendor advisory or project release notes. If no upstream patch is available, implement custom remediation through code review and input sanitization—specifically, use prepared statements or parameterized queries for all database operations involving the social_twitter parameter and any other user-supplied input in the admin interface.

Detection guidance

Monitor admin panel access logs (/admin/adminHome.php requests) for unusual query parameters, especially the social_twitter field containing SQL metacharacters or encoded SQL keywords. Web Application Firewall (WAF) rules should flag attempts to inject SQL commands such as UNION SELECT, OR 1=1, DROP TABLE, or comment sequences (-- or /*) in parameter values. Database audit logs can reveal suspicious queries executed by authenticated admin accounts that deviate from normal gallery operations. Check for unusual outbound queries or access to sensitive tables by authenticated sessions.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score due to its authentication requirement, the combination of publicly disclosed exploits, the ease of SQL injection attacks, and the access to the admin panel make it a priority. Any compromise of admin credentials—whether through password reuse, phishing, or brute force on weak credentials—immediately enables data theft or manipulation. Organizations should prioritize this as an urgent remediation task if they run this project version.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects: Network-based attack vector, low attack complexity, low privileges required (authenticated user), and impact to confidentiality, integrity, and availability. The score does not account for the public availability of working exploits or the severity of SQL injection flaws in administrative interfaces. In practice, the effective risk may be elevated if admin credentials are weak, default, or widely shared within the organization.

Frequently asked questions