SQL Injection in Online Art Gallery Shop 1.0: Unauthenticated User Data Exposure

Summary

An unpatched security weakness in the Online Art Gallery Shop 1.0 allows an attacker to potentially steal sensitive user data. This is because the software does not properly verify user input, making it vulnerable to a common type of cyber attack. To protect your data, update the software to the latest version or consider replacing it with a more secure alternative.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
projectworlds	online_art_gallery_shop	1.0	–

Original title

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The ma...

Original description

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ubfbuz3/cve/issues/55 Exploit Third Party Advisory Issue Tracking
https://vuldb.com/?ctiid.348301 Permissions Required VDB Entry
https://vuldb.com/?id.348301 Third Party Advisory VDB Entry
https://vuldb.com/?submit.763740 Exploit Third Party Advisory VDB Entry