PT-2026-30590 · Phpgurukul · Phpgurukul Online Shopping Portal Project

F1Rstb100D · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5641

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Shopping Portal Project version 2.1

Description A SQL injection issue exists in PHPGurukul Online Shopping Portal Project 2.1. The issue is located in the /admin/update-image1.php file, within a component identified as the Parameter Handler. Manipulation of the filename argument can lead to SQL injection. The attack can be performed remotely and the exploit has been made public.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-5641

Affected Products

Phpgurukul Online Shopping Portal Project

References · 9

• 🔥 https://github.com/f1rstb100d/CVE/issues/19 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5641 · Security Note
• https://twitter.com/VulmonFeeds/status/2041110130872181080 · Twitter Post
• https://twitter.com/CVEnew/status/2041094982115737911 · Twitter Post
• https://vuldb.com/vuln/355429 · Note
• https://vuldb.com/submit/785993 · Note
• https://twitter.com/infoflowcloud/status/2041096229514297566 · Twitter Post
• https://vuldb.com/vuln/355429/cti · Note
• https://phpgurukul.com · Note