Executive brief
A security vulnerability exists in the PHPGurukul Online Shopping Portal, a web application used for managing e-commerce storefronts. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information, modification of product data, or disruption of the shopping service. This issue is particularly serious because a proof-of-concept exploit has been made public.
Technical details
A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal Project 2.1 within the '/categorywise-products.php' file. The root cause is the failure of the Parameter Handler component to properly sanitize or validate the 'cid' GET parameter before using it in a database query. A remote attacker with low privileges can exploit this via boolean-based blind, time-based blind, or UNION-based SQL injection techniques. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public exploit (PoC) has been released.
Affected products
- PHPGurukul Online Shopping Portal Project 2.1
Timeline
- 2026-03-23: disclosed: Initial disclosure on GitHub by researcher f1rstb100d
- 2026-04-06: advisory: NVD and VulDB published the advisory