This vulnerability in PHPGurukul News Portal Project 4.1 allows remote attackers to perform SQL injection via the sadminusername parameter in the /admin/add-subadmins.php file. The flaw arises from improper input validation or sanitization, enabling attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official fix or patch is currently available, and the vendor has not issued remediation instructions. The vulnerability is publicly disclosed but not known to be exploited in the wild.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands on the backend database, potentially leading to data leakage, modification, or corruption. The impact is limited by the requirement for high privileges (PR:H) and low complexity of attack (AC:L). There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted administrators only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the sadminusername parameter.