Executive brief
The Vehicle Management System is a web-based application used to manage vehicle fleet operations. The application contains a SQL injection vulnerability in its busid parameter that allows unauthenticated remote attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion of business-critical information.
Technical details
A SQL injection vulnerability exists in the Vehicle Management System 1.0, specifically in the /busprofile.php file where the busid parameter is processed without proper input validation or parameterized queries. An attacker can supply malicious SQL syntax in the busid parameter to manipulate the underlying database query. The vulnerability is network-accessible and requires no authentication. Successful exploitation allows an attacker to read, modify, or delete database contents. Public proof-of-concept code is available, increasing the risk of active exploitation.
Affected products
- code-projects Vehicle Management System 1.0
Timeline
- 2026-09-04: disclosed
- exploited: Public exploit code available