CVE-2026-5640

A SQL injection vulnerability exists in the PHPGurukul Online Shopping Portal Project version 2.1, specifically in the /admin/update-image2.php file. The filename parameter is directly used in SQL queries without proper sanitization, allowing an attacker to inject malicious SQL code [2].

Exploitation is possible remotely via HTTP POST requests. The attacker manipulates the filename parameter within multipart form data. No authentication is required as the vulnerable endpoint is accessible to unauthenticated users. The public disclosure of a proof-of-concept payload demonstrates the ease of exploitation [2].

Successful exploitation allows an attacker to perform time-based blind SQL injection to extract database contents, modify or delete data, and potentially gain complete control over the application and its underlying database. This leads to sensitive data leakage and service disruption [2].

As of the publication date, no official patch has been released. The vendor was notified but the status is unknown. Users should consider restricting access to the /admin/ directory and applying input validation as a temporary workaround.