The vulnerability resides in the ExportParkingRecords API endpoint of Das Parking Management System 6.2.0. By manipulating the Value argument, an attacker can inject arbitrary SQL statements. The injected payload is passed to the Microsoft SQL Server stored procedure xp_cmdshell, which, if executed, would run the supplied string as an operating‑system command. This behavior is inferred from the function name used; the description does not explicitly confirm command execution, but the presence of xp_cmdshell strongly implies that successful exploitation could lead to OS‑level code execution.

The only documented vulnerable release is Das Parking Management System 6.2.0. No information is available about whether earlier or later versions are affected, so administrators should verify the exact version of their deployment.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The advisory states that a public exploit is available and that the attack can be launched remotely from outside the network, indicating a realistic risk. No patch has been issued by the vendor at this time, making timely mitigation essential.