The code-projects Vehicle Management 1.0 application contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) triggered by improper sanitization of the company parameter in the /addcompany.php file. The vulnerability is remotely exploitable without requiring authentication from the attacker.

Successful exploitation of this flaw allows an attacker to inject arbitrary SQL commands into the backend database. This could lead to unauthorized data exfiltration, modification of application records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption or the compromise of sensitive organizational data.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /addcompany.php endpoint via network controls or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /addcompany.php that contain SQL syntax patterns, such as UNION, SELECT, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the application input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations using Vehicle Management 1.0 must prioritize the implementation of compensating controls. Since a vendor patch is not confirmed, strict network segmentation and WAF-based filtering are essential to mitigate the risk until the vendor provides a secure update.