PT-2025-7125 · Unknown · Phpgurukul Online Shopping Portal
CVE-2025-26156
·
Published
2025-02-14
·
Updated
2025-04-02
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHPGurukul Online Shopping Portal version 2.1
Description
A SQL Injection issue was found in the
/shopping/track-orders.php file, allowing remote attackers to execute arbitrary code via the orderid POST request parameter.Recommendations
For PHPGurukul Online Shopping Portal version 2.1, consider disabling the
/shopping/track-orders.php file or restricting access to it until a patch is available. Avoid using the orderid parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Phpgurukul Online Shopping Portal