The vulnerability in phpgurukul Online Shopping Portal 2.0 allows arbitrary files to be uploaded to the /admin/insert-product.php endpoint due to missing extension validation. This flaw is classed as CWE-434 and can enable an attacker to upload malicious scripts or other executable files, potentially leading to remote code execution, data theft, or further compromise of the web application.

The vulnerability affects phpgurukul Online Shopping Portal version 2.0. The admin product insertion page located at /admin/insert-product.php is the specific point of exploitation.

The CVSS score of 9.1 reflects a high severity risk of remote code execution. The EPSS score of < 1% indicates that, at the time of this analysis, the probability of exploitation observed in the wild is low, but the flaw remains critical. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a web‑based POST request to the upload endpoint, typically requiring authenticated admin access or a side‑channel that bypasses authentication. Exploitation would involve crafting a request with a malicious file extension that the system does not filter, thereby allowing the attacker to place a payload that the server will execute.