The vulnerability allows an attacker to manipulate the STAFF_ID parameter within /util/StaffDetailsFunction.php, causing arbitrary SQL commands to run against the application's database. This can result in unauthorized data access, modification, or deletion, compromising confidentiality and integrity of the system. The flaw falls under input validation weaknesses, specifically CWE-74 and CWE-89. The impact is further amplified because the attack can be launched remotely and the exploit code is publicly available.

The affected vendor is code-projects, product Vehicle Showroom Management System, version 1.0. The vulnerability is limited to the StaffDetailsFunction.php file, which is part of the system’s user management module. No other products or versions were mentioned as affected.

The CVSS score of 6.9 indicates a medium severity vulnerability. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. However, the publicly available exploit indicates that attackers can target this flaw remotely, most likely through HTTP requests to the vulnerable endpoint. The lack of a patch or mitigation from the vendor increases the risk that attackers can leverage the vulnerability before a fix is released.