The vulnerability resides in a function of /admin/check_availability.php that accepts a Username parameter. An attacker can supply a crafted value that is not properly sanitized, allowing a malicious SQL statement to be executed against the underlying database. This type of injection can enable unauthorized read, modify, or delete operations on stored data. The description explicitly states that the flaw is exploitable remotely, indicating that an unauthenticated web request could be used to trigger the flaw.

PHPGurukul News Portal Project, version 4.1. The affected component is the check_availability.php script located in the /admin directory of the project. No other versions or vendors are listed in the CNA data.

The CVSS score of 5.1 places the issue in the medium severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploitation. However, the description confirms that the flaw is remotely exploitable, likely via a standard HTTP GET or POST request to /admin/check_availability.php with a manipulated Username parameter. Since the attack vector is inferred from the available information, the exact prerequisites (such as authentication or required session state) remain unclear.