This vulnerability involves an SQL injection flaw in the PHPGurukul Online Shopping Portal Project (versions 2.0 and 2.1). The issue is located in the /pending-orders.php file's parameter handler where the ID argument is not properly sanitized, allowing remote attackers to inject malicious SQL commands. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code has been published, but no vendor fix or mitigation has been disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the lack of user interaction, but the exact scope of data exposure or system compromise is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying manual input validation or parameterized queries to the affected ID parameter in /pending-orders.php to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.