This vulnerability involves an SQL injection in the PHPGurukul Online Shopping Portal Project 2.1. The injection point is the 'cid' parameter in the /categorywise-products.php file's parameter handler component. An attacker can remotely exploit this flaw without user interaction or privileges to manipulate SQL queries executed by the application. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No vendor-provided patch or official remediation is documented at this time. Public exploit code exists, which may facilitate attacks.

Successful exploitation of this SQL injection vulnerability could allow attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the database permissions and application context. The vulnerability is remotely exploitable without authentication. However, the CVSS vector indicates low complexity and low privileges required, with limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries for the 'cid' parameter in /categorywise-products.php to mitigate SQL injection risks. Monitor relevant application components for suspicious activity related to this parameter. Avoid deploying the affected version in production environments if possible.