CVE-2026-10874: projectworlds Online Art Gallery Shop Project adminHome.php sql injection
A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.php. The manipulation of the argument socialinsta leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the SQL injection by updating /admin/adminHome.php to validate and sanitize the social_insta parameter and use parameterized queries/prepared statements or stored procedures for any database access. Enforce strict input validation (allow only expected characters/format) and escape or encode output as appropriate.
projectworlds Online Art Gallery Shop Project - /admin/adminHome.php social_insta input handling / database query = use server-side input validation and parameterized queries (prepared statements); restrict allowed characters/format for social_insta - Compensating control
Until the code is fixed, restrict access to the administrative interface (/admin) to trusted IP addresses or a VPN and deploy a web application firewall or SQLi rules (e.g., mod_security) to block malicious payloads targeting the social_insta parameter.
- Operational
Search web server and database logs for requests containing the social_insta parameter and indicators of SQL injection; investigate for signs of unauthorized access or data exfiltration. If compromise is suspected, rotate any potentially exposed credentials and restore affected data from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10874?
The severity of CVE-2026-10874 is rated medium with a score of 6.3.
How do I fix CVE-2026-10874?
To fix CVE-2026-10874, validate and sanitize the input for the social_insta parameter in the adminHome.php file to prevent SQL injection.
What type of vulnerability is CVE-2026-10874?
CVE-2026-10874 is classified as an SQL Injection vulnerability.
Can CVE-2026-10874 be exploited remotely?
Yes, CVE-2026-10874 can be exploited remotely through the manipulation of the social_insta parameter.
Which software is affected by CVE-2026-10874?
CVE-2026-10874 affects the Projectworlds Online Art Gallery Shop Project version 1.0.