Executive brief
A security vulnerability exists in the PHPGurukul Online Shopping Portal, a web application used for managing e-commerce storefronts. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or the modification of store data. This could result in significant data breaches and disruption of business operations.
Technical details
A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal Project 2.1 within the '/sub-category.php' file. The root cause is the improper neutralization of the 'pid' GET parameter, which is used directly in SQL queries without sufficient validation or sanitization. A remote attacker with low privileges can provide a malicious payload (such as time-based blind SQL injection) to execute unauthorized database operations. This can lead to sensitive data leakage, data tampering, or full database compromise. A public exploit (PoC) has been disclosed, but no official patch is currently documented in the advisory.
Affected products
- PHPGurukul Online Shopping Portal Project 2.1
Timeline
- 2026-03-19: disclosed: Initial disclosure on GitHub by f1rstb100d
- 2026-04-05: advisory: NVD and VulDB published the vulnerability details