CVE-2026-5606
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PHPGurukul Online Shopping Portal Project 2.1 is vulnerable to SQL injection via the 'orderid' parameter in the file /order-details.php. An attacker can remotely manipulate this parameter, leading to unauthorized SQL queries.
Risk Assessment
An attacker can gain unauthorized access to the database, including sensitive user data, passwords, or order information, and potentially take control of the application.
Recommendation
Immediately apply a patch from the vendor or implement input validation and parameterized SQL queries for the 'orderid' parameter.
Other vulnerabilities in PHPGurukul Online Shopping Portal
See all- CVE-2024-44659Critical
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL injection via the email parameter in forgot-password.php.
- CVE-2026-5560Medium
A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the file /payment-method.php. Manipulation of the paymethod argument allows remote attack. The exploit has been made public.
- CVE-2026-5552Medium
A SQL injection vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.1 in the file /sub-category.php. Manipulation of the pid argument allows remote attack. The exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.php of the component Parameter Handler. The manipulation of the argument orderid results in sql injection. It is possible to launch the attack remotely.