Description
A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Published: 2026-04-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized database manipulation
Action: Patch Immediately
AI Analysis

Impact

The vulnerability originates from the MonthTotalReportUpdateFunction.php script in Vehicle Showroom Management System 1.0. An attacker can manipulate the BRANCH_ID argument to inject arbitrary SQL because the input is not validated or escaped. This flaw allows direct tampering of or data extraction from the database, potentially compromising confidentiality, integrity, or availability of the system's data.

Affected Systems

Code-projects Vehicle Showroom Management System version 1.0 is affected. The security issue is confined to the MonthTotalReportUpdateFunction.php file, and no other versions or components are listed as vulnerable.

Risk and Exploitability

With a CVSS score of 6.9, the vulnerability is considered moderate. EPSS is not provided and it is not cataloged in KEV. Since it can be carried out remotely through web requests and an exploit is publicly available, attackers can exploit this flaw without authentication. The lack of an official patch or workaround increases the risk for systems exposed to untrusted networks.

Generated by OpenCVE AI on April 13, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor patch or upgrade to a newer release once available
  • If no patch exists, restrict access to MonthTotalReportUpdateFunction.php or its API to trusted IP ranges
  • Implement proper input validation and parameterized queries for the BRANCH_ID parameter
  • Deploy a web application firewall rule to block SQL injection patterns targeting BRANCH_ID
  • Monitor database logs for anomalous queries or unauthorized data modifications

Generated by OpenCVE AI on April 13, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects vehicle Showroom Management System
Vendors & Products Code-projects
Code-projects vehicle Showroom Management System

Mon, 13 Apr 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Title code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Vehicle Showroom Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-16T13:36:45.201Z

Reserved: 2026-04-12T17:59:22.531Z

Link: CVE-2026-6148

cve-icon Vulnrichment

Updated: 2026-04-16T13:26:43.467Z

cve-icon NVD

Status : Deferred

Published: 2026-04-13T02:16:05.483

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-13T12:53:43Z

Weaknesses