This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1, specifically in an unknown function within /payment-method.php that handles the 'paymethod' parameter. Improper input validation allows an attacker to inject SQL commands remotely, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been documented, and the vulnerability is publicly known but not yet exploited in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the vulnerability's low scope and impact metrics, but it still poses a significant risk to data integrity and confidentiality within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the 'paymethod' parameter to prevent SQL injection. Monitor vendor communications for updates regarding an official patch or mitigation.