Description
A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-04-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized data access or modification
Action: Immediate Patch
AI Analysis

Impact

This vulnerability resides in the PHPGurukul Online Shopping Portal Project 2.1 within the file categorywise-products.php. The vulnerability arises when the cid parameter is manipulated, allowing attackers to inject arbitrary SQL statements. The result can be unauthorized retrieval of sensitive data, manipulation of database contents, or other data integrity violations. It is a classic input validation weakness (CWE-74 and CWE-89) that can expose confidential user and transaction information.

Affected Systems

Affected systems are installations of the PHPGurukul Online Shopping Portal Project. The reported impact applies to version 2.1 of the portal; other versions are not confirmed to be vulnerable. Any server that hosts the component Parameter Handler and exposes the /categorywise-products.php endpoint may be susceptible.

Risk and Exploitability

The CVSS score for this issue is 5.3, indicating medium severity. EPSS is unavailable and the flaw is not included in the CISA KEV catalog. Attackers can exploit the flaw remotely via HTTP requests that include a crafted cid value, and the exploit code has been publicly released. Because the vulnerability allows SQL injection, it is readily exploitable in a typical web environment, especially when the underlying database credentials run with sufficient privileges.

Generated by OpenCVE AI on April 6, 2026 at 11:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch that fixes the SQL injection in the cid parameter or upgrade to a newer release of the PHPGurukul portal that addresses the issue.
  • If an official patch is not yet available, restrict access to the /categorywise-products.php endpoint to trusted IP addresses or networks using web server configuration or firewall rules.
  • Implement input validation on the cid parameter on the server side, ensuring it accepts only numeric values and using parameterized queries.
  • Verify that the database user account used by the application has the minimum required privileges to reduce the impact of any successful injection.
  • Monitor logs for anomalous SQL activity and perform regular vulnerability scans to confirm the issue is resolved.

Generated by OpenCVE AI on April 6, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection
First Time appeared Phpgurukul
Phpgurukul online Shopping Portal Project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul online Shopping Portal Project
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul Online Shopping Portal Project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T14:54:55.270Z

Reserved: 2026-04-05T19:16:47.021Z

Link: CVE-2026-5635

cve-icon Vulnrichment

Updated: 2026-04-06T14:54:49.525Z

cve-icon NVD

Status : Deferred

Published: 2026-04-06T08:16:39.910

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:33:09Z

Weaknesses