This vulnerability involves SQL injection in the PHPGurukul Online Shopping Portal Project 2.1 due to insufficient input validation or sanitization of the 'pid' parameter in the /sub-category.php component's parameter handler. An attacker can remotely manipulate this parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been released, and the exploit code is publicly available.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected application database. The impact is rated medium, indicating limited but non-negligible risk to confidentiality, integrity, and availability of data handled by the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries or prepared statements for the 'pid' parameter in /sub-category.php to prevent SQL injection. Monitor for updates from the vendor regarding patches or official mitigations.