Executive brief
A vulnerability has been identified in the Vehicle Showroom Management System, a software platform used to manage automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive customer information, tampering with vehicle inventory records, or disruption of dealership business operations.
Technical details
A SQL injection vulnerability exists in code-projects Vehicle Showroom Management System 1.0 within the /util/BookVehicleFunction.php component. The root cause is the improper neutralization of special elements in the 'BRANCH_ID' POST parameter, which is used directly in SQL queries without validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests containing boolean-based or time-based blind SQL payloads. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of records. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Initial disclosure on GitHub by security researchers
- 2026-04-13: advisory: CVE published and VulDB entry created