This vulnerability involves an SQL injection flaw in the PHPGurukul Online Shopping Portal Project 2.1. The issue arises from improper handling of the 'filename' parameter in the /admin/update-image1.php script, allowing an attacker to inject malicious SQL queries. The vulnerability is remotely exploitable without requiring user interaction or elevated privileges, but it has low complexity and limited impact on confidentiality, integrity, and availability as indicated by the CVSS 4.0 vector. No official fix or vendor advisory has been published to date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the vulnerable 'filename' parameter. This may lead to unauthorized data access or modification, but the overall impact is rated as medium severity with limited confidentiality, integrity, and availability impact. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries on the affected component to mitigate SQL injection risks. Monitor for updates from PHPGurukul regarding patches or official mitigations.