This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1 and involves an SQL injection via the 'fullname' parameter in the /my-profile.php file's Parameter Handler component. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor, and the vulnerability is publicly known but not confirmed to be exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the medium severity score and the requirement for low privileges to exploit. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'fullname' parameter to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.