CVE-2026-5552

Vulnerability

Analysis

A SQL injection vulnerability has been identified in PHPGurukul Online Shopping Portal Project version 2.1. The issue resides in the /sub-category.php component, specifically the pid parameter, is processed without proper sanitization or validation. This allows an attacker to inject arbitrary SQL commands through the GET parameter, as the input is directly concatenated into SQL queries [2].

Exploitation

The vulnerability can be exploited remotely without authentication. An attacker can craft a malicious HTTP request to /sub-category.php with a specially crafted pid parameter. Proof-of-concept code has been publicly released, demonstrating time-based blind SQL injection using payloads such as 1' AND (SELECT 9224 FROM (SELECT(SLEEP(5)))kztz) AND 'EawF'='EawF [2]. This technique allows an attacker to extract information from the database by observing response delays.

Impact

Successful exploitation enables an attacker to gain unauthorized access to the underlying database. This can lead to sensitive data leakage (e.g., user credentials, personal information), data tampering, and potentially full control over the application and server. The vendor's website provides general information about PHP and database security but does not mention a specific patch for this version [1].

Mitigation

As of the publication date, no official patch has been released by PHPGurukul for this vulnerability. Users are advised to implement input validation and parameterized queries (e.g., using PDO prepared statements) for the pid parameter in /sub-category.php. Until a fix is available, restricting network access to the application and monitoring for suspicious requests are recommended temporary measures.