The target vulnerability resides in the /sub‑category.php page of the PHPGurukul Online Shopping Portal Project, where the pid request argument is concatenated into an SQL statement without sanitization. An attacker can supply a crafted pid value in a URL query string or form field, causing the application to execute arbitrary SQL commands on the database. This yields unauthorized read, modify, or delete access to the underlying data. Because no user authentication or additional checks are required to reach the vulnerable code, an unauthenticated attacker can obtain the full benefit of the injection.

Any installation of PHPGurukul Online Shopping Portal Project version 2.1 that exposes the /sub‑category.php endpoint and uses the Parameter Handler component is potentially compromised. The vendor listing does not extend beyond the 2.1 release, so earlier or later versions are not implied to be affected unless they contain identical code paths.

The CVSS base score of 5.3 indicates medium severity. EPSS information is unavailable, and the issue is not present in the CISA KEV catalogue, yet a public exploit has been released, proving real‑world exploitability. Based on the description, the likely attack vector is a remote HTTP request to the exposed /sub‑category.php page, which can be delivered via web browsers or automated scripts. Successful exploitation can disrupt the confidentiality, integrity, and availability of the database while exposing sensitive customer data.