This vulnerability affects PHPGurukul News Portal Project 4.1 in the /admin/add-subadmins.php file. An attacker can manipulate the sadminusername argument to perform SQL injection attacks remotely. This allows potential unauthorized access or modification of the backend database. The CVSS 4.0 base score is 5.1, indicating a medium severity level with network attack vector, low complexity, and no privileges required for the attack. No official fix or patch has been published yet, and the vulnerability state is published as of April 2026.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to the requirement of some privileges (PR:H) and the low exploitability complexity. There is no evidence of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected admin functionality and monitor for suspicious activity related to the sadminusername parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.