Executive brief
A vulnerability exists in the Vehicle Showroom Management System, a web application used for managing automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive customer and business information or the disruption of showroom operations. This attack can be carried out remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in code-projects Vehicle Showroom Management System 1.0 within the '/util/StaffAddingFunction.php' component. The root cause is the improper neutralization of special elements in the 'STAFF_ID' POST parameter, which is used directly in SQL queries without validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted SQL payloads (including boolean-based, error-based, and UNION-based techniques) to manipulate database queries. This can result in unauthorized data retrieval, modification, or full database compromise. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System Project 1.0
Timeline
- 2026-04-03: disclosed: Vulnerability details and PoC shared on GitHub by researcher zheng-lv
- 2026-04-13: advisory: CVE-2026-6152 published