CVE-2026-3406 is a high severity (CVSS 7.3) SQL injection in projectworlds Online Art Gallery Shop 1.0, in the admin registration page. The record says an exploit is public. No vendor fix is listed, so remove the app from public networks or replace the vulnerable code with parameterized queries.
What's affected
The record lists projectworlds Online Art Gallery Shop version 1.0. The flaw is in /admin/registration.php, in the Registration Handler, through the fname argument.
The record does not list a patched version, and the references are a GitHub issue and VulDB entries rather than a vendor advisory. I could not confirm any fixed release. Treat version 1.0 as vulnerable.
How to check if you're exposed
Find out whether this application runs anywhere in your environment. Search web roots and container images for the path /admin/registration.php together with the project name. Sample projects of this kind are often copied onto test servers and forgotten.
If you find it, check whether it is reachable from the internet. Review the web server access log for requests to the admin registration page from unfamiliar addresses.
The CVSS vector shows network access with no privileges, which means the page needs no login to be reached.
What to do now
- Search your hosts and repositories for the Online Art Gallery Shop code.
- Take any internet-facing copy offline, or block it with an allowlist.
- If you need the app, change the registration code to use prepared statements with bound parameters.
- Review the database for added admin accounts or altered rows.
- Move to a maintained shopping platform for anything that handles real customers or payments.
Why it matters
The record lists CWE-89 (SQL injection) and CWE-74 (injection in general). The input called fname ends up inside a SQL statement without safe handling, so the database may treat part of it as a command.
Projects like this are teaching samples and small scripts. They rarely get patches, which is why the safest answer is often to retire them. The record does not mark the CVE as exploited, and it is not on the CISA KEV list, but it does say the exploit has been made public.
Quick check
Can I patch it myself?
Yes, by switching the affected query to a prepared statement, but nobody has published a vendor fix. Replace the code if the app matters.
Sources
Last reviewed: 19 October 2026.
