A critical SQL injection vulnerability in code-projects Vehicle Management 1.0 allows remote, unauthenticated attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) located in the addvehicle.php script. The application fails to properly sanitize the vehicle parameter, allowing an unauthenticated attacker to inject malicious SQL queries remotely.

The successful exploitation of this vulnerability could lead to unauthorized access to the application database, potentially resulting in data exfiltration, modification, or deletion. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of system information. Such breaches can lead to severe reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable addvehicle.php functionality entirely.

Proactive Monitoring: Security teams should monitor database logs for abnormal query patterns, specifically those containing SQL syntax or unusual string concatenations, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability must be treated with high urgency. Organizations using this software should immediately restrict network access to the affected components and monitor for suspicious activity until a formal vendor patch is released.