Description
A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-04-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch
AI Analysis

Impact

The SQL injection vulnerability resides in PHPGurukul Online Shopping Portal Project version 2.1, specifically in the /admin/update-image2.php script. An attacker who can control the filename parameter can inject arbitrary SQL statements through the Parameter Handler. This flaw is aligned with CWE‑89 and CWE‑74 and enables unauthorized database access or manipulation, potentially compromising application data integrity and confidentiality.

Affected Systems

The vulnerability affects the PHPGurukul Online Shopping Portal Project, version 2.1. No other vendors or products are listed as impacted. The admin component that handles image updates is the target entry point.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is deemed moderate, and no EPSS data or KEV listing is available. However, the attack is remotely exploitable via HTTP requests to the admin script, and a public exploit is already available, implying that an attacker with network access could obtain or alter database contents without authentication, so proactive mitigation is advised.

Generated by OpenCVE AI on April 6, 2026 at 11:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Ensure only authorized administrators can reach /admin/update-image2.php, for example by enforcing authentication or restricting access by IP address.
  • Sanitize or validate the filename input, accepting only expected characters, and use parameterized database queries to eliminate injection vulnerabilities.
  • Apply any vendor‑issued patch or update for PHPGurukul when it becomes available.
  • Monitor web server logs for suspicious requests targeting the filename parameter or the admin script.
  • If no fix is currently available, isolate the affected component from the network or disable the feature until remediation can be applied.

Generated by OpenCVE AI on April 6, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Title PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection
First Time appeared Phpgurukul
Phpgurukul online Shopping Portal Project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul online Shopping Portal Project
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul Online Shopping Portal Project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T14:53:48.116Z

Reserved: 2026-04-05T20:31:03.537Z

Link: CVE-2026-5640

cve-icon Vulnrichment

Updated: 2026-04-06T14:53:44.604Z

cve-icon NVD

Status : Deferred

Published: 2026-04-06T09:16:18.700

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5640

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:33:02Z

Weaknesses