Executive brief
A vulnerability exists in the Vehicle Showroom Management System, a web application used for managing automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive business data, modification of vehicle records, or disruption of the management system's availability.
Technical details
A SQL injection vulnerability exists in code-projects Vehicle Showroom Management System 1.0 within the '/util/AddVehicleFunction.php' file. The root cause is the improper neutralization of the 'BRANCH_ID' POST parameter before its use in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based and time-based blind techniques) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion. The exploit has been publicly disclosed via GitHub issues, and no official patch is currently documented.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Vulnerability details and PoC published on GitHub
- 2026-04-10: advisory: CVE-2026-6037 published