Description
A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.php. This manipulation of the argument BRANCH_ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-04-10
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection – Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

A flaw in the Vehicle Showroom Management System allows an attacker to inject arbitrary SQL commands through the BRANCH_ID parameter in the AddVehicleFunction.php file. The injection can be executed remotely and leverages input that is not properly sanitized, exposing the system to read, modify, or delete data within its database. The weakness aligns with both CWE-74 (Improper Parsing of User-Submitted Data) and CWE-89 (Improper Neutralization of Special Elements used in SQL).

Affected Systems

The vulnerability is present only in code‑projects Vehicle Showroom Management System version 1.0, specifically affecting the /util/AddVehicleFunction.php script. No other versions or products are listed as impacted.

Risk and Exploitability

This issue carries a CVSS score of 6.9, indicating medium severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, yet it is publicly disclosed and can be triggered remotely without authentication, increasing the likelihood of exploitation. An attacker who can reach the affected endpoint may gain unauthorized database access.

Generated by OpenCVE AI on April 10, 2026 at 10:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Vehicle Showroom Management System to the latest available version or apply any official vendor patch if one exists
  • Refactor AddVehicleFunction.php to use prepared statements or parameterized queries and validate the BRANCH_ID input strictly as a numeric value
  • Limit access to the endpoint by requiring authentication or restricting it to trusted IP addresses
  • Monitor and analyze web server logs for injection attempts and block suspicious IP addresses

Generated by OpenCVE AI on April 10, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects vehicle Showroom Management System
Vendors & Products Code-projects
Code-projects vehicle Showroom Management System

Fri, 10 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.php. This manipulation of the argument BRANCH_ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Title code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Vehicle Showroom Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-14T14:37:44.352Z

Reserved: 2026-04-09T16:23:43.936Z

Link: CVE-2026-6037

cve-icon Vulnrichment

Updated: 2026-04-14T14:37:39.251Z

cve-icon NVD

Status : Deferred

Published: 2026-04-10T09:16:25.000

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6037

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-13T13:06:17Z

Weaknesses