The flaw arises in Vehicle Showroom Management System’s PaymentStatusFunction.php, where the CUSTOMER_ID parameter is concatenated directly into a SQL query without any input validation. This allows an attacker to inject arbitrary SQL statements, enabling the read, modification, or deletion of sensitive data stored in the database. Because the injection can be triggered through a normal HTTP request to the vulnerable page, the attack can be performed remotely with minimal effort, potentially leading to loss of confidentiality, integrity, and availability of database contents.

All installations of code‑projects Vehicle Showroom Management System, version 1.0, are impacted, as the vulnerability resides in the utility file /util/PaymentStatusFunction.php. Any instance that accepts a CUSTOMER_ID value without proper sanitization is susceptible.

The vulnerability carries a CVSS score of 6.9, indicating a medium severity risk. The EPSS score is not available, so the likelihood of exploitation remains unclear, but the public exploit and remote attack vector suggest that it can be exercised with relative ease. The vulnerability is not listed in the KEV catalog, yet it can be leveraged through straightforward HTTP requests to the affected endpoint.