This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1 in the /order-details.php component's Parameter Handler. Specifically, the 'orderid' argument can be manipulated to inject SQL commands remotely, potentially compromising database integrity or confidentiality. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited scope and impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits have been reported.

Successful exploitation allows remote attackers to perform SQL injection via the 'orderid' parameter, which may lead to unauthorized access or modification of database information. The impact is limited to the confidentiality, integrity, and availability of the affected database components as indicated by the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or parameterized queries as temporary mitigations to prevent SQL injection. Monitor vendor channels for updates.