A critical SQL injection vulnerability in code-projects Vehicle Management 1.0 allows for remote, unauthenticated database manipulation, posing a significant risk to data integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered via the vehicle argument in the /filter1.php file. The attack vector is network-based and requires no authentication, allowing an unauthenticated remote attacker to interact with the backend database.

The ability to perform SQL injection allows an attacker to interact directly with the application database, potentially leading to unauthorized data exposure, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the system. Successful exploitation could result in significant operational disruption and the compromise of sensitive organizational information.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the /filter1.php endpoint via network controls or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Review web server access logs for suspicious patterns in the vehicle parameter, such as SQL syntax characters or unexpected query strings, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection payloads targeting the vehicle parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub reference provided in the vulnerability disclosure.

Given the public availability of exploit details and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk to any deployment of Vehicle Management 1.0. Administrators must prioritize isolating the affected application or implementing stringent WAF filtering to prevent unauthorized database access while awaiting a permanent security update.