A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System allows unauthenticated remote attackers to execute arbitrary database queries.

The application fails to properly sanitize the STAFF_ID parameter within the /util/StaffAddingFunction.php script, which leads to SQL injection. This flaw is accessible to unauthenticated remote attackers who can interact directly with the vulnerable endpoint.

Successful exploitation of this vulnerability allows an attacker to manipulate backend database queries, potentially leading to unauthorized data extraction or modification. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the application, which could lead to severe reputational damage or unauthorized access to sensitive showroom management data.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /util/StaffAddingFunction.php file or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at the StaffAddingFunction.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the STAFF_ID parameter.

Public Exploit Available: Yes — a public proof-of-concept exists, as documented in the security researcher's write-up at the referenced GitHub repository.

Due to the lack of an official vendor patch and the availability of public exploit material, this vulnerability presents a high risk to the application environment. Security teams must prioritize isolating the affected component and implementing robust input validation via a WAF until a permanent fix is issued by the vendor.