This vulnerability allows an attacker to inject malicious SQL code via the Comment argument in the /news-details.php file of PHPGurukul News Portal Project 4.1. The injection occurs due to insufficient input validation or sanitization, enabling remote attackers to potentially interfere with the backend database. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, indicating limited damage scope. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the Comment parameter.