A critical SQL injection vulnerability in code-projects Vehicle Management 1.0 exposes the application to remote, unauthenticated data manipulation.

This is a SQL injection flaw (CWE-89) affecting the company parameter within the /updatebal.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

The ability for an unauthenticated user to inject arbitrary SQL commands poses a significant risk to the integrity and confidentiality of the underlying database. With a CVSS score of 7.3, this flaw enables attackers to potentially bypass security controls, extract sensitive information, or disrupt application services, leading to potential data loss or operational downtime.

Immediate Action: As no official patch is currently available, users should restrict access to the /updatebal.php file or implement input validation and parameterized queries in the source code to sanitize the company argument.

Proactive Monitoring: Monitor web server access logs for anomalous requests to /updatebal.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the specified application endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations using this software must treat this as a high-priority security concern. Until an official vendor update is released, administrators should prioritize restricting access to the vulnerable endpoint or implementing robust input validation to prevent unauthorized database interaction.