CVE-2026-5558

Vulnerability

Overview

A SQL injection vulnerability exists in the PHPGurukul Online Shopping Portal Project up to version 2.1. The flaw resides in the unknown function of the file /pending-orders.php, where user input passed via the id GET parameter is directly incorporated into SQL queries without proper sanitization or validation [1][2]. This lack of parameterized queries (despite the vendor's PDO tutorials on PDO usage) allows an attacker to inject malicious SQL statements.

Attack

Vector

An unauthenticated attacker can exploit this vulnerability remotely by sending a crafted HTTP GET request to /pending-orders.php with a malicious id parameter. Proof-of-concept payloads have been published, including a time-based blind SQL injection using RLIKE and SLEEP() functions [2]. No special privileges or network position beyond internet access is required.

Impact

Successful exploitation can lead to unauthorized database access, sensitive data leakage (e.g., customer credentials, order details), data manipulation, denial of service, and potentially full system compromise [2]. The impact severity is heightened by the remote attack vector and published exploit code.

Mitigation

As of the advisory date, no patch has been confirmed. The vendor's official website offers the vulnerable software version [1]. Users are advised to apply input validation, use prepared statements with PDO, and limit database user privileges until a fix is released. Given the published exploit, this vulnerability may be considered for inclusion in CISA KEV.