This vulnerability involves an SQL injection in the PHPGurukul Online Shopping Portal Project version 2.1, specifically in the /categorywise-products.php component's handling of the 'cid' parameter. Attackers can remotely manipulate this parameter to execute arbitrary SQL commands due to insufficient input validation. The issue is confirmed and publicly documented under CVE-2026-5635 with a CVSS 4.0 score of 5.3 (medium severity). No official fix or patch has been published, and the product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized access or manipulation of the backend database. The impact is rated medium with a CVSS score of 5.3, reflecting limited but significant risk. There is no indication of privilege escalation or complete system compromise from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. In the meantime, applying input validation or parameterized queries to sanitize the 'cid' parameter can help mitigate the risk. Avoid exposing vulnerable endpoints publicly if possible until a fix is released.