A critical SQL injection vulnerability in code-projects Vehicle Management 1.0 exposes the application to unauthorized database manipulation by remote, unauthenticated attackers.

This vulnerability is a SQL injection flaw (CWE-89) triggered through the from parameter in the filter2.php file. The vulnerability is remotely exploitable without requiring authentication, as indicated by the CVSS vector.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized data exfiltration, modification of application records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, necessitating prompt attention to prevent unauthorized access to sensitive information.

Immediate Action: As no official patch is currently available, users should restrict access to the affected file or the entire application via network-level controls until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server access logs for anomalous requests to filter2.php, specifically looking for input strings containing SQL syntax such as single quotes, semicolons, or common SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a layer of protection until the underlying code is remediated.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

The vulnerability presents a clear and present danger to the application due to the availability of proof-of-concept code and the ease of remote exploitation. Security teams should prioritize limiting exposure of the Vehicle Management application to untrusted networks and verify that all input handling in the application is audited for proper sanitization. Contact the vendor for updates and apply them immediately upon release to remediate the flaw.