The vulnerability is a code injection flaw (CWE‑74) combined with a classic SQL injection (CWE‑89) that occurs when the orderid parameter in order-details.php is not properly sanitized. An attacker can inject arbitrary SQL statements, enabling them to read, modify, or delete data from the database behind the application. This could compromise customer information, transaction records, and overall data integrity.

The affected product is PHPGurukul: Online Shopping Portal Project version 2.1. Only that version is explicitly listed as vulnerable in the advisory, and the flaw resides in the order-details.php component of the Parameter Handler submodule.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote through an HTTP request that supplies a crafted orderid argument. An attacker with network reach to the web server could exploit the vulnerability without additional credentials, making exploitation relatively straightforward.