CVE-2025-65647
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter.
Risk Assessment
An attacker can access order information of other users, potentially leading to a breach of data confidentiality.
Recommendation
Implement access control for resources, ensuring that users can only access their own orders, for example by verifying permissions based on user identity.
Other vulnerabilities in PHPGURUKUL Online Shopping Portal
See all- CVE-2024-44659Critical
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL injection via the email parameter in forgot-password.php.
- CVE-2026-5640Medium
A SQL Injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the /admin/update-image2.php file within the Parameter Handler component. Manipulation of the filename argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-5639Medium
A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project version 2.1. An unknown function in /admin/update-image3.php is impacted, where manipulation of the filename argument can lead to SQL injection. The attack can be executed remotely, and a public exploit is available.
- CVE-2026-5606Medium
PHPGurukul Online Shopping Portal Project 2.1 is vulnerable to SQL injection via the 'orderid' parameter in the file /order-details.php. An attacker can remotely manipulate this parameter, leading to unauthorized SQL queries.
- CVE-2026-5560Medium
A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the file /payment-method.php. Manipulation of the paymethod argument allows remote attack. The exploit has been made public.
- CVE-2026-5552Medium
A SQL injection vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.1 in the file /sub-category.php. Manipulation of the pid argument allows remote attack. The exploit has been made public.
- CVE-2024-44662Medium
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2025-61096Medium
PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter.
Original NVD description (English source)
Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS