This vulnerability affects PHPGurukul News Portal Project 4.1 and involves SQL injection via the Comment argument in the /news-details.php file. An attacker can remotely inject SQL commands by manipulating this parameter, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability is publicly known but no official fix or patch has been documented.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database through the Comment parameter. This could lead to unauthorized data access, modification, or deletion depending on the database permissions. The vulnerability does not require user interaction or privileges, increasing its risk. However, the impact is rated medium due to limited details on the extent of data exposure or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database user permissions may reduce potential impact.