The vulnerability is a classic SQL injection in the complaint-details.php endpoint of PHPgurukul’s Complaint Management System 2.0. By manipulating the cid query parameter, an attacker can inject arbitrary SQL commands, allowing the reading, modification, or deletion of database data and compromising data confidentiality, integrity, and potentially availability. The weakness is classified as CWE‑89.

This issue affects the PHPgurukul Complaint Management System 2.0. No other versions or vendors are known to be affected at the time of this advisory.

The CVSS vector scores the vulnerability as 6.5, which falls in the medium range, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not included in the CISA Known Exploit Vulnerabilities catalog. Attackers can reach the flaw by sending crafted HTTP requests to complaint-details.php; authentication is not mentioned, so the exposure may be unauthenticated or require user‑level access. Because the flaw is in a publicly reachable web parameter, the risk surface is significant enough to warrant priority remediation.