Description
A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Published: 2026-04-09
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in the /news-details.php page of the PHPGurukul News Portal Project where the Comment parameter is not properly sanitized. This opens an avenue for SQL injection, allowing an attacker to craft malicious input that can alter database queries. The vulnerability is directly exploitable through the public web interface, and could lead to unauthorized data disclosure, modification, or deletion of user information, depending on the database privileges of the web application.

Affected Systems

The affected product is PHPGurukul News Portal Project, version 4.1, deployed by vendors at PHPGurukul. The specific file impacted is news-details.php, and attacks target the Comment input field presented to users via the portal.

Risk and Exploitability

The CVSS score of 6.9 classifies this as a moderate severity flaw. No EPSS score is supplied, and it is not listed in the CISA KEV catalog, but the exploit has been made publicly available, indicating real-world usage. Attackers can initiate the payload remotely by submitting a crafted comment through the portal, with no authentication required. Given these conditions, the risk of exploitation remains significant while the potential impact could compromise confidentiality and integrity of stored data.

Generated by OpenCVE AI on April 9, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for PHPGurukul News Portal Project that addresses the SQL injection in news-details.php.
  • If a patch is unavailable, sanitize the Comment parameter and enforce strict input validation or use parameterized queries.
  • Deploy a web application firewall rule set that blocks common SQL injection patterns for the Comment field.
  • Limit access to the news-details.php endpoint to authenticated users only, if appropriate for the application context.
  • Monitor web traffic for suspicious query patterns and alert on potential injection attempts.

Generated by OpenCVE AI on April 9, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Apr 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Title PHPGurukul News Portal Project news-details.php sql injection
First Time appeared Phpgurukul
Phpgurukul news Portal Project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:phpgurukul:news_portal_project:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul news Portal Project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul News Portal Project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-09T03:15:12.498Z

Reserved: 2026-04-08T17:32:10.455Z

Link: CVE-2026-5837

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-09T04:17:23.597

Modified: 2026-04-09T04:17:23.597

Link: CVE-2026-5837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:25:06Z

Weaknesses