The Vehicle Showroom Management System version 1.0 contains a remote SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries.

This flaw is a SQL injection vulnerability (CWE-89) located in the /util/AddVehicleFunction.php file. An unauthenticated attacker can exploit this by manipulating the BRANCH_ID argument to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized access to the application database, potential data exfiltration, or modification of sensitive vehicle and showroom records. With a CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, particularly for systems managing business operations.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /util/AddVehicleFunction.php endpoint or disable the vulnerable module entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the BRANCH_ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests containing malicious SQL injection payloads directed at the vulnerable file.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the referenced GitHub issue.

Given the public availability of exploit code and the ease of remote execution, this vulnerability poses a significant risk to the integrity of the application. Organizations should prioritize isolating the affected system from public-facing networks and monitor for unauthorized activity until a permanent security update is provided by the vendor.