Executive brief
A security vulnerability exists in the PHPGurukul Online Shopping Portal Project, a web application used for managing e-commerce operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or the disruption of store services. This issue affects the order details functionality and can be triggered remotely by a logged-in user.
Technical details
A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal Project 2.1 within the '/order-details.php' file. The root cause is the improper neutralization of the 'orderid' POST parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote attacker with low-level privileges (authenticated user) can exploit this via boolean-based or time-based blind SQL injection techniques. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of records. No official patch has been confirmed, but remediation involves implementing prepared statements with parameter binding.
Affected products
- PHPGurukul Online Shopping Portal Project 2.1
Timeline
- 2026-03-20: disclosed: Vulnerability reported on GitHub by researcher f1rstb100d.
- 2026-04-06: advisory: CVE-2026-5606 published.