Description
A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddingFunction.php. This manipulation of the argument STAFF_ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-04-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection enabling unauthorized database manipulation
Action: Immediate Patch
AI Analysis

Impact

A flaw in the handling of the STAFF_ID argument within the StaffAddingFunction.php file allows an attacker to inject arbitrary SQL statements into the database query, resulting in uncontrolled read, modification, or deletion of data. The vulnerability is classified under CWE-74 and CWE-89, and it can lead to compromise of confidentiality, integrity, and availability of the application’s database.

Affected Systems

The issue affects code‑projects' Vehicle Showroom Management System version 1.0. It is triggered by requests that reach the /util/StaffAddingFunction.php endpoint, with the STAFF_ID parameter being improperly validated. No other versions or products are reported as affected at this time.

Risk and Exploitability

The CVSS score of 6.9 denotes a medium severity flaw. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability can be triggered remotely using crafted HTTP requests, implying that an adversary with network access to the web server could exploit it from any location. The combination of remote reachability, lack of patch availability, and medium impact elevates the risk but does not reach critical, making remediation a high priority.

Generated by OpenCVE AI on April 13, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any official patch or update released by code‑projects immediately.
  • If no patch exists, modify StaffAddingFunction.php to use parameterized queries or prepared statements and validate that STAFF_ID contains only numeric characters.
  • Limit the staff addition functionality to authenticated administrators and enforce strict role‑based access controls.
  • Deploy a web application firewall or input filtering rules to detect and block typical SQL injection patterns, and monitor database logs for anomalous activity.

Generated by OpenCVE AI on April 13, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects vehicle Showroom Management System
Vendors & Products Code-projects
Code-projects vehicle Showroom Management System

Mon, 13 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 02:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddingFunction.php. This manipulation of the argument STAFF_ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Title code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Vehicle Showroom Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-13T11:47:41.319Z

Reserved: 2026-04-12T17:59:35.706Z

Link: CVE-2026-6152

cve-icon Vulnrichment

Updated: 2026-04-13T11:47:35.357Z

cve-icon NVD

Status : Deferred

Published: 2026-04-13T03:16:03.097

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6152

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-13T12:53:38Z

Weaknesses