The code-projects Vehicle Showroom Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary database commands.

The application is vulnerable to SQL injection (CWE-89) within the /util/UpdateVehicleFunction.php file. Attackers can exploit this by injecting malicious input into the VEHICLE_ID argument, which is processed without sufficient sanitization.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of information stored within the showroom management database.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected script or disable the module entirely until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters targeting the /util/UpdateVehicleFunction.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the VEHICLE_ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue tracker referenced by the vulnerability record.

Due to the availability of a public proof-of-concept and the lack of an official patch, organizations using this software are at elevated risk. Immediate isolation of the vulnerable component is required to prevent potential database compromise until the vendor provides a remediation update.