This vulnerability involves an SQL injection in the PHPGurukul News Portal Project 4.1, specifically in the /admin/check_availability.php file. By manipulating the Username parameter, an attacker can inject SQL code remotely without user interaction or privileges beyond high-level access. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required. The vulnerability is publicly disclosed with a public exploit available, but no vendor fix or patch has been documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the requirement of high privileges (PR:H) and low vulnerability and attack complexity. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries on the Username parameter in /admin/check_availability.php to mitigate SQL injection risks. Monitor official PHPGurukul channels for updates and patches.