Executive brief
A vulnerability exists in the Vehicle Showroom Management System, a web application used to manage automotive inventory and sales. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive customer information or the modification of business records. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in the '/util/VehicleDetailsFunction.php' file of the Vehicle Showroom Management System v1.0. The root cause is the improper neutralization of the 'VEHICLE_ID' POST parameter before it is used in a SQL query. A remote, unauthenticated attacker can provide specially crafted input (such as boolean-based, error-based, or time-based payloads) to manipulate database queries. This can lead to unauthorized data extraction, modification, or full database compromise. Public proof-of-concept exploits using sqlmap have been disclosed. No official patch is currently noted, but remediation involves implementing prepared statements and parameter binding.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Initial disclosure on GitHub by security researchers
- 2026-04-10: advisory: CVE published and VulDB entry created