# CVE-2026-5552: PHPGurukul Online Shopping Portal SQL injection in sub-category.php

Source: https://junglewise.ai/threats/cve-2026-5552-phpgurukul-online-shopping-portal-sql-injection-in-sub-category  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5552 · Severity: medium · CVSS 6.3 · Published 2026-04-05

A security vulnerability exists in the PHPGurukul Online Shopping Portal, a web application used for managing e-commerce storefronts. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or the modification of store data. This could result in significant data breaches and disruption of business operations.

Technologies: [Phpgurukul Online Shopping Portal Project](https://junglewise.ai/threats/technologies/online-shopping-portal-project). Vendors: [Phpgurukul](https://junglewise.ai/threats/vendors/phpgurukul).

## Quick answers

**Is CVE-2026-5552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5552 being exploited in the wild.

**How severe is CVE-2026-5552?** Medium severity, with a CVSS score of 6.3, published 5 April 2026.

**Which products and versions are affected?** Phpgurukul Online Shopping Portal Project 2.1.

**Is there a fix for CVE-2026-5552?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5552 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-5552?** Check whether you run Phpgurukul Online Shopping Portal Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal Project 2.1 within the '/sub-category.php' file. The root cause is the improper neutralization of the 'pid' GET parameter, which is used directly in SQL queries without sufficient validation or sanitization. A remote attacker with low privileges can provide a malicious payload (such as time-based blind SQL injection) to execute unauthorized database operations. This can lead to sensitive data leakage, data tampering, or full database compromise. A public exploit (PoC) has been disclosed, but no official patch is currently documented in the advisory.

## Affected products

- PHPGurukul Online Shopping Portal Project 2.1

## Timeline

- 2026-03-19: disclosed: Initial disclosure on GitHub by f1rstb100d
- 2026-04-05: advisory: NVD and VulDB published the vulnerability details

## References

- [https://github.com/f1rstb100d/CVE/issues/10](https://github.com/f1rstb100d/CVE/issues/10)
- [https://phpgurukul.com/](https://phpgurukul.com/)
- [https://vuldb.com/submit/782864](https://vuldb.com/submit/782864)
- [https://vuldb.com/vuln/355316](https://vuldb.com/vuln/355316)
- [https://vuldb.com/vuln/355316/cti](https://vuldb.com/vuln/355316/cti)

## Related threats

- [PHPGurukul Online Shopping Portal SQL injection in cancelorder.php](https://junglewise.ai/threats/cve-2026-5636-phpgurukul-online-shopping-portal-sql-injection-in-cancelorder-php)
- [PHPGurukul Online Shopping Portal SQL injection in categorywise-products.php](https://junglewise.ai/threats/cve-2026-5635-phpgurukul-online-shopping-portal-sql-injection-in-categorywise)
- [PHPGurukul Online Shopping Portal SQL injection in order-details.php](https://junglewise.ai/threats/cve-2026-5606-phpgurukul-online-shopping-portal-sql-injection-in-order-details)
- [PHPGurukul Online Shopping Portal SQL injection in my-profile.php](https://junglewise.ai/threats/cve-2026-5583-phpgurukul-online-shopping-portal-sql-injection-in-my-profile-php)
- [PHPGurukul Online Shopping Portal SQL injection in payment-method.php](https://junglewise.ai/threats/cve-2026-5560-phpgurukul-online-shopping-portal-sql-injection-in-payment-method)