Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows an unauthenticated attacker to execute arbitrary SQL queries by injecting malicious code through the features[] parameter in a POST request to index.php. The vulnerability can be exploited to extract sensitive database information or to modify database queries, thereby compromising the confidentiality and integrity of the application’s data. The weakness is identified as CWE‑89.

The vulnerability applies to the Netartmedia PHP Car Dealer product. No specific version information is provided in the CVE data, so all current installations may be affected until an official fix is applied.

The CVSS score is 8.8, indicating a high severity assessment. The EPSS score is reported as less than 1 %, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a remote HTTP POST request containing a crafted payload in the features[] field, with no authentication or privileged access required. The attack vector is therefore remote, unauthenticated, and publicly reachable.