A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System 1.0 allows for unauthenticated remote attackers to potentially access or manipulate database contents.

This vulnerability is a SQL injection flaw (CWE-89) located in the /util/VehicleDetailsFunction.php file. An unauthenticated attacker can exploit this remotely by sending a malicious request containing a crafted VEHICLE_ID parameter.

Successful exploitation of this flaw could allow an attacker to bypass security controls, leading to unauthorized access to sensitive data stored within the application database. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to data confidentiality and integrity, potentially resulting in data exfiltration or unauthorized modification of system records.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the vulnerable component until a security update is released by the vendor.

Proactive Monitoring: Security teams should implement database activity monitoring to detect anomalous query patterns or unexpected SQL syntax originating from the /util/VehicleDetailsFunction.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the references (https://github.com/TAnNbR/CVE/issues/3).

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability must be treated with high priority. Organizations utilizing the Vehicle Showroom Management System should immediately isolate the affected instance from public-facing networks and apply strict input validation rules at the WAF level to mitigate the threat of SQL injection.