An unauthenticated SQL injection vulnerability in the code-projects Vehicle Showroom Management System 1.0 poses a significant risk of remote data compromise.

This is a SQL injection vulnerability (CWE-89) located in the /util/RegisterCustomerFunction.php file. An unauthenticated attacker can exploit this flaw by injecting malicious SQL commands into the BRANCH_ID parameter.

Successful exploitation of this vulnerability allows unauthorized access to backend database information. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it enables remote attackers to potentially exfiltrate sensitive customer data or interfere with system operations, leading to significant reputational and operational damage.

Immediate Action: Since a formal vendor patch is currently unavailable, administrators should restrict network access to the vulnerable application and consider taking it offline until the code can be manually audited or a patch is released.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /util/RegisterCustomerFunction.php, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and filter incoming traffic targeting the affected parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Due to the lack of an official patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing this software should immediately implement compensating controls or restrict access to the application to prevent potential data breaches.