This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1, specifically in the Parameter Handler component within the /sub-category.php file. Manipulation of the 'pid' argument leads to SQL injection, enabling remote attackers to potentially interfere with the backend database queries. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the exploit has been made public.

Successful exploitation allows remote attackers to perform SQL injection attacks via the 'pid' parameter, potentially leading to unauthorized data access or modification in the backend database. The impact is rated medium severity with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 vector. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the 'pid' parameter. Monitor for updates from PHPGurukul regarding patches or official mitigations.