CVE-2026-5640

PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection

View on CVE.org
Published Apr 6, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Analysis

AI-generated

Technical impact

The SQL injection vulnerability resides in PHPGurukul Online Shopping Portal Project version 2.1, specifically in the /admin/update-image2.php script. An attacker who can control the filename parameter can inject arbitrary SQL statements through the Parameter Handler. This flaw is aligned with CWE‑89 and CWE‑74 and enables unauthorized database access or manipulation, potentially compromising application data integrity and confidentiality.

Affected Systems

The vulnerability affects the PHPGurukul Online Shopping Portal Project, version 2.1. No other vendors or products are listed as impacted. The admin component that handles image updates is the target entry point.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is deemed moderate, and no EPSS data or KEV listing is available. However, the attack is remotely exploitable via HTTP requests to the admin script, and a public exploit is already available, implying that an attacker with network access could obtain or alter database contents without authentication, so proactive mitigation is advised.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure only authorized administrators can reach /admin/update-image2.php, for example by enforcing authentication or restricting access by IP address.
  • Sanitize or validate the filename input, accepting only expected characters, and use parameterized database queries to eliminate injection vulnerabilities.
  • Apply any vendor‑issued patch or update for PHPGurukul when it becomes available.
  • Monitor web server logs for suspicious requests targeting the filename parameter or the admin script.
  • If no fix is currently available, isolate the affected component from the network or disable the feature until remediation can be applied.

Generated by OpenCVE AI on April 6, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Title PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection
First Time appeared Phpgurukul
Phpgurukul online Shopping Portal Project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:phpgurukul:online_shopping_portal_project:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul online Shopping Portal Project
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 6, 2026, 2:53 PM
Reserved
Apr 5, 2026, 8:31 PM

View source JSON

Updated
Apr 6, 2026, 2:53 PM

JSON

Status
Deferred
Published
Apr 6, 2026, 9:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 6, 2026, 9:33 PM

JSON