The vulnerability allows an attacker to inject arbitrary SQL commands through the manage_category.php script in the Vehicle Parking Area Management System. This flaw could enable unauthorized read, update, or deletion of data stored in the underlying database, compromising confidentiality and possibly integrity of the parking records.

SourceCodester Vehicle Parking Area Management System, version 1.0. The only affected file is parking/manage_category.php.

No CVSS score or EPSS information is provided, so the precise severity cannot be quantified. Because the injection is reachable via a standard HTTP request to the vulnerable PHP page, attackers with web access may exploit it if the system is exposed to the internet. The vulnerability is not listed in CISA's KEV catalog. In the absence of an official patch, the risk remains until mitigated.