# CVE-2026-109606: SourceCodester Art Gallery Management System SQL injection in account creation

Source: https://junglewise.ai/threats/cve-2026-109606-a-vulnerability-was-detected-in-sourcecodester-art-gallery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109606 · Severity: high · CVSS 7.3 · Published 2026-10-13

SourceCodester Art Gallery Management System is a web application for managing art galleries and collections. The system's account creation endpoint lacks authentication and is vulnerable to SQL injection, allowing an unauthenticated attacker to create administrator accounts and gain complete control of the application. This could lead to data theft, system manipulation, or complete compromise of the gallery's digital assets.

Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-109606 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109606 being exploited in the wild.

**How severe is CVE-2026-109606?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** SourceCodester Art Gallery Management System 1.0.

**Is there a fix for CVE-2026-109606?** No fixed version is recorded yet. Add session and admin-role authentication checks to all admin/ajax.php actions. Remove extract($_POST) and whitelist input fields explicitly. Use prepared statements for all SQL queries and disable display_errors in production. Do not accept user_type from client input. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109606 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109606?** Check whether you run SourceCodester Art Gallery Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Add session and admin-role authentication checks to all admin/ajax.php actions. Remove extract($_POST) and whitelist input fields explicitly. Use prepared statements for all SQL queries and disable display_errors in production. Do not accept user_type from client input.

## Technical details

The vulnerability is a pre-authentication SQL injection (CWE-89, CWE-862) in the admin/ajax.php save_user action, which dispatches directly to Action::save_user() without session or role checks. The function uses extract($_POST) and raw string interpolation in SQL queries; an attacker can inject SQL via the name parameter to set user_type='1' and create an admin account. Exploitation requires no authentication, network access only, and results in administrative privilege escalation.

## Affected products

- SourceCodester Art Gallery Management System 1.0

## Timeline

- 2026-09-25: disclosed: Vulnerability reproduced in local lab
- 2026-10-13: advisory: CVE-2026-109606 published

## References

- [https://tracexlabs.com/releases/art-gallery-preauth-admin.html](https://tracexlabs.com/releases/art-gallery-preauth-admin.html)
- [https://vuldb.com/cve/CVE-2026-109606](https://vuldb.com/cve/CVE-2026-109606)