This vulnerability affects PHPGurukul News Portal Project 4.1, specifically in the /admin/add-subcategory.php script. The sucatdescription parameter is susceptible to SQL injection due to insufficient input validation or sanitization. An attacker with high privileges can remotely exploit this flaw to execute arbitrary SQL commands, potentially impacting data confidentiality and integrity. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been published as of the current data.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to unauthorized data access or modification within the affected application database. The impact is limited to the scope of the vulnerability in the specified parameter and does not indicate full system compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing additional input validation or web application firewall rules to detect and block SQL injection attempts targeting the sucatdescription parameter.