Executive brief
A SQL injection vulnerability exists in the Vehicle Showroom Management System, a web application used for managing automotive inventory. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive customer or business data, modification of records, or disruption of the management system. This vulnerability can be exploited remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in the '/util/UpdateVehicleFunction.php' component of the Vehicle Showroom Management System 1.0. The root cause is the improper neutralization of the 'VEHICLE_ID' parameter before its use in a SQL query. A remote, unauthenticated attacker can send specially crafted HTTP POST requests to manipulate database queries. Successful exploitation allows for boolean-based blind, error-based, time-based blind, and UNION-based SQL injection, enabling full database extraction or modification. Public exploit code (PoC) using sqlmap payloads has been disclosed.
Affected products
- code-projects Vehicle Showroom Management System Project 1.0
Timeline
- 2026-04-04: disclosed: Initial disclosure on GitHub issues
- 2026-04-13: advisory: CVE-2026-6166 published