The Vehicle Showroom Management System is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /util/StaffDetailsFunction.php file. The flaw is triggered via the STAFF_ID parameter and can be exploited by an unauthenticated attacker remotely.

The ability for an unauthenticated user to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to bypass authentication mechanisms, view sensitive staff records, or potentially modify database content, leading to unauthorized access and business disruption.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and consider disabling the vulnerable functionality if it is not business critical.

Proactive Monitoring: Security teams should implement strict input validation on all web forms and monitor server logs for unusual SQL syntax patterns or unauthorized access attempts targeting the /util/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and monitor for anomalous traffic patterns directed at the identified vulnerable PHP file.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a clear and present risk. Organizations using the Vehicle Showroom Management System should immediately isolate the application from public-facing networks. Until a formal security update is released, prioritize the implementation of robust WAF filtering to mitigate the risk of exploitation.