Art Gallery Management System CVE-2026-109606

No special conditions beyond network reachability - the input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, unauthenticated attacker can reach the Account Creation feature of SourceCodester Art Gallery Management System 1.0 and inject SQL through the 'Name' argument processed by Action::save_user in admin/admin_class.php, with no authentication or user interaction required. The primary limiting factors are deployment-related rather than technical: the attacker must have network access to an exposed instance of this niche application, and exploitation targets the specific account-creation code path, so installations that restrict access to the admin endpoint or run patched/modified code are less exposed.

Signals are mixed and point to a moderate, opportunistic risk rather than an emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with score 6.9 describes a remote, low-complexity, unauthenticated SQL injection, and a public exploit exists (VulDB-sourced, with a dedicated TraceXLabs 'pre-auth admin' release), so weaponization effort is already low. However, this is NOT in CISA KEV (no confirmed active exploitation) and no EPSS score was provided, so widespread automated exploitation cannot be asserted. The input CVSS 4.0 exploit maturity is E:P (Proof-of-Concept), which is consistent with 'POC available' but explicitly NOT 'attacked/in-the-wild'. The vulnerable-system impacts are only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), which caps the raw severity; yet the exploit's naming ('preauth-admin') suggests the practical outcome may be unauthorized administrative account creation, which would be more serious than the Low impact metrics imply - this discrepancy should be verified against the actual POC. The dominant risk mitigant is product footprint: SourceCodester Art Gallery Management System is a small educational/hobby PHP application, so real-world exposure is minimal. Net: a genuinely exploitable pre-auth SQLi with public POC, but low deployment prevalence and no KEV listing make it a low-to-moderate operational priority for most organizations.

A remote, unauthenticated attacker submits a crafted value in the 'Name' parameter to the account-creation handler (Action::save_user in admin/admin_class.php), injecting SQL that the backend executes. A public proof-of-concept exists (TraceXLabs 'art-gallery-preauth-admin' release), lowering the skill required; given AV:N/AC:L/PR:N the attacker needs only network reachability to the application and no credentials.