Executive brief
A vulnerability exists in the Vehicle Showroom Management System, a web application used to manage automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive staff or customer information and the modification of business records. This attack can be carried out remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in the '/util/StaffDetailsFunction.php' component of code-projects Vehicle Showroom Management System 1.0. The root cause is the improper neutralization of special elements in the 'STAFF_ID' POST parameter, which is used directly in SQL queries without validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to perform boolean-based, error-based, time-based, or UNION-based SQL injection. This allows for full database extraction, data tampering, and potential administrative bypass. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-03: disclosed: Initial disclosure on GitHub issue tracker
- 2026-04-13: advisory: CVE published by VulDB