This vulnerability involves an SQL injection in the PHPGurukul Online Shopping Portal Project 2.1, specifically in the /order-details.php component's handling of the orderid parameter. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no vendor advisory or patch information available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity. However, the overall impact is rated medium due to limited details on the extent of database access or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the orderid parameter to mitigate SQL injection risks. Monitor vendor channels for updates and apply patches promptly once released.