A SQL injection vulnerability in the SourceCodester Vehicle Parking Area Management System allows authenticated administrative users to execute arbitrary database commands.

The application is susceptible to SQL injection within the /parking/view_parked_details.php endpoint. This flaw requires an attacker to possess administrative privileges to successfully execute malicious SQL queries against the backend database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exfiltration, modification of database records, or a complete compromise of the application backend. Given the CVSS score of 7.2, the vulnerability presents a high risk to organizational data integrity and confidentiality, potentially leading to unauthorized access to sensitive parking and user information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administrative interface to trusted internal networks only.

Proactive Monitoring: Review application logs for suspicious database queries containing SQL syntax characters or unusual patterns directed at the view_parked_details.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up referenced in the CVE record.

Given the high CVSS severity and the presence of a public proof-of-concept, this vulnerability poses a significant risk to systems running the affected software. Since a vendor patch is currently unavailable, organizations must prioritize the implementation of compensating controls, such as strict network access controls and WAF filtering, to mitigate the risk of unauthorized database manipulation.