Description
A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Affected by this issue is some unknown functionality of the file /util/BookVehicleFunction.php. Executing a manipulation of the argument BRANCH_ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-04-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL injection that can lead to data disclosure or modification.
Action: Immediate Update
AI Analysis

Impact

A flaw in the BookVehicleFunction.php component of code‑projects Vehicle Showroom Management System 1.0 allows attackers to manipulate the BRANCH_ID argument, leading to an unsanitized SQL query. This remote SQL injection can be leveraged to read, modify, or delete database contents, creating a risk of data tampering and loss of confidentiality. The weakness aligns with CWE‑89, unsupported user input in SQL statements.

Affected Systems

The vulnerability affects the Vehicle Showroom Management System, version 1.0, released by code‑projects. No additional affected versions are listed, and the flaw is tied specifically to the /util/BookVehicleFunction.php file.

Risk and Exploitability

The CVSS v3 score of 6.9 indicates a medium‑to‑high impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can execute the exploit remotely, and published proof‑of‑concept code exists. Given these conditions, the likelihood of exploitation is moderate, and organizations running the vulnerable product should prioritize remediation.

Generated by OpenCVE AI on April 13, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest available update or patch for Vehicle Showroom Management System.
  • If an official patch is not yet released, restrict external access to the /util/BookVehicleFunction.php endpoint or move it behind authentication.
  • Modify the application to validate and sanitize the BRANCH_ID input before it is used in SQL statements.
  • Replace concatenated SQL statements with parameterized queries or prepared statements.
  • Monitor web server and database logs for signs of injection attempts and review user privileges regularly.

Generated by OpenCVE AI on April 13, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects vehicle Showroom Management System
Vendors & Products Code-projects
Code-projects vehicle Showroom Management System

Mon, 13 Apr 2026 02:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Affected by this issue is some unknown functionality of the file /util/BookVehicleFunction.php. Executing a manipulation of the argument BRANCH_ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Title code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Vehicle Showroom Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-13T15:19:08.443Z

Reserved: 2026-04-12T17:59:26.373Z

Link: CVE-2026-6149

cve-icon Vulnrichment

Updated: 2026-04-13T15:19:04.563Z

cve-icon NVD

Status : Deferred

Published: 2026-04-13T02:16:05.697

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6149

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-13T12:53:42Z

Weaknesses