This vulnerability affects PHPGurukul Online Shopping Portal Project 2.1, specifically in the /admin/update-image2.php file's parameter handler. An attacker can remotely manipulate the filename argument to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been published as of the data provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the application's database. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. However, the impact is rated as low for confidentiality, integrity, and availability, suggesting limited or partial data exposure or modification. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries on the filename parameter in /admin/update-image2.php to prevent SQL injection. Monitor for any updates from PHPGurukul regarding patches or mitigations.