This vulnerability involves an SQL injection flaw in the PHPGurukul Online Shopping Portal Project 2.1, specifically in the /cancelorder.php component's parameter handling of 'oid'. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. The vulnerability is publicly known but no vendor fix or patch has been disclosed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability, suggesting the damage scope is moderate. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the 'oid' parameter in /cancelorder.php.