A flaw in the Parameter Handler of the file pending-orders.php allows an attacker to manipulate the ID argument, resulting in a SQL injection opportunity. The vulnerability can be exploited remotely, enabling the attacker to read, modify, or delete sensitive data in the database, thereby compromising confidentiality and integrity. The weakness is categorized as CWE-74 and CWE-89, indicating an improper handling of user input within a SQL context.

The affected product is the PHPGurukul Online Shopping Portal Project, versions up to 2.1. No newer versions were identified in the available data, so all installations of 2.1 or earlier are potentially vulnerable.

The CVSS score of 5.3 places this flaw at medium severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but an exploit has already been published, indicating that the risk of exploitation is real. Attackers can remote trigger the injection via the ID parameter, suggesting a simple execution path without requiring privileged access. Given the medium score, the potential impact combined with public exploitation suggests prompt mitigation.