Executive brief
A vulnerability exists in the Vehicle Showroom Management System, a software platform used to manage automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive customer information, tampering with sales records, or disrupting business operations. This attack can be performed remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in the '/util/MonthTotalReportUpdateFunction.php' file of the Vehicle Showroom Management System version 1.0. The root cause is the improper neutralization of the 'BRANCH_ID' POST parameter before it is used in a SQL query. An unauthenticated remote attacker can provide malicious input (such as boolean-based or time-based blind payloads) to manipulate database logic. This can result in unauthorized data retrieval, modification, or deletion. A public exploit (PoC) using sqlmap has been disclosed, confirming the vulnerability's exploitability. No official patch is currently documented, but remediation involves using prepared statements and parameter binding.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Initial discovery and PoC shared on GitHub.
- 2026-04-12: advisory: VulDB published advisory.
- 2026-04-13: other: CVE record published.