Executive brief
A security vulnerability exists in the Vehicle Showroom Management System, a software used to manage automotive dealership operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive customer information, tampering with vehicle records, or disruption of the management service.
Technical details
A SQL injection vulnerability exists in the '/util/Login_check.php' component of code-projects Vehicle Showroom Management System 1.0. The root cause is the improper neutralization of special elements within the 'id' parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending specially crafted POST requests (including boolean-based, error-based, and time-based blind payloads) to manipulate database logic. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of records. Public proof-of-concept exploits using sqlmap have been disclosed.
Affected products
- code-projects Vehicle Showroom Management System 1.0
Timeline
- 2026-04-04: disclosed: Initial disclosure on GitHub issues
- 2026-04-13: advisory: CVE-2026-6165 published