A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System allows unauthenticated remote attackers to compromise the application database.

This is a SQL injection flaw (CWE-89) triggered by improper input validation of the ID parameter within the /util/Login_check.php file. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform remote SQL injection poses a significant risk to the confidentiality, integrity, and availability of the application. An attacker could potentially extract sensitive user data, bypass authentication mechanisms, or modify database records, leading to unauthorized access and potential system compromise. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable Vehicle Showroom Management System until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /util/Login_check.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk while awaiting a vendor-supplied patch. Failure to address this flaw could lead to a full database compromise.