This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1, specifically in the /my-profile.php file's Parameter Handler component. An attacker can manipulate the 'fullname' parameter to perform SQL injection attacks remotely. The CVSS 4.0 base score is 5.3 (medium severity), indicating that the attack vector is network-based with low attack complexity and no privileges or user interaction required. The vulnerability is publicly disclosed, but no official fix or patch has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the 'fullname' parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the 'fullname' parameter to mitigate SQL injection risks. Monitor for any vendor updates or patches addressing this issue.