This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1. An attacker can remotely exploit a SQL injection flaw by manipulating the filename parameter in the /admin/update-image3.php script. The vulnerability allows injection of SQL commands due to insufficient input validation or sanitization in the parameter handler. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official remediation or patch has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and sanitization on the filename parameter as a temporary mitigation. Monitoring for unusual database queries or access patterns related to this endpoint may also help detect exploitation attempts.