The PHPGurukul Online Shopping Portal Project 2.1 contains a flaw in the Parameter Handler of the my-profile.php page. The fullname argument can be manipulated to inject arbitrary SQL statements, potentially leading to disclosure, modification, or deletion of data stored in the underlying database. This vulnerability is a classic SQL injection, as indicated by the CWE‑74 and CWE‑89 identifiers. The impact is primarily on the confidentiality and integrity of the application’s data.

This issue affects the PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability resides in an undefined portion of my-profile.php within the Parameter Handler component. No additional versions are listed, so only systems running this build are known to be vulnerable.

The CVSS score for the flaw is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a crafted HTTP request that includes a malicious fullname value to the my-profile.php endpoint. No special privileges or additional steps are required beyond reaching the application, so the vulnerability is readily exploitable.