This vulnerability involves an SQL injection in the PHPGurukul Online Shopping Portal Project 2.1, specifically in the /admin/update-image3.php file's Parameter Handler component. An attacker can remotely manipulate the 'filename' parameter to inject SQL code, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official remediation or patch has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and the absence of known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'filename' parameter to prevent SQL injection. Monitor vendor communications for updates regarding patches or official mitigations.