A remote SQL injection vulnerability in code-projects Vehicle Management 1.0 poses a significant risk of unauthorized data access and manipulation.

The application is susceptible to SQL injection (CWE-89) due to improper sanitization of the from argument in the /filter.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database. This could lead to unauthorized data exposure, modification, or deletion of sensitive information, potentially resulting in total system compromise. Given the CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to protect organizational data integrity.

Immediate Action: As no official patch is currently identified, users should restrict access to the /filter.php endpoint or disable the vulnerable Vehicle Management component entirely until a vendor-provided update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual requests directed at the /filter.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable argument.

Public Exploit Available: Yes, a public proof-of-concept exists, attributed to the research write-up at https://github.com/wllovemy/cve/issues/1.

The presence of a public proof-of-concept combined with the ease of remote exploitation makes this a high-priority concern. Organizations using code-projects Vehicle Management 1.0 must treat this as an urgent matter, implementing WAF protections and restricting access to the affected module immediately while awaiting official vendor remediation.