A paymethod parameter in the payment-method.php component of the PHPGurukul Online Shopping Portal Project is not validated before being used in a SQL statement, creating an injectable point. This vulnerability is a classic example of SQL injection, where an attacker can alter database queries. The weakness is characterized by the CWE identifiers CWE‑74 (XSS with SQL injection) and CWE‑89 (SQL Injection). The exploitation of this flaw would allow a remote attacker to read, modify, or delete database records, thereby compromising confidentiality, integrity, and availability of the shopping portal.

The issue is present in version 2.1 of the PHPGurukul Online Shopping Portal Project. The affected component is the Parameter Handler within payment‑method.php. No other product versions are listed in the CNA data.

The CVSS score of 5.3 indicates a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the web, as attackers can manipulate the paymethod argument through HTTP requests. Exploitation requires that payment-method.php be publicly accessible and that the paymethod input is passed unsanitized into a database query. The public availability of a working exploit further raises the risk of successful attacks.