CVE-2024-48245 describes an SQL Injection vulnerability in Vehicle Management System 1.0. The flaw exists in POST parameters related to administrative functions, including Booking ID, Action Name, and Payment Confirmation ID, which are processed by /newvehicle.php and /newdriver.php. An unauthenticated guest user can exploit this to inject malicious SQL queries, potentially compromising confidentiality, integrity, and availability of the system data. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to read, modify, or delete sensitive data in the backend database, affecting confidentiality, integrity, and availability of the Vehicle Management System. Since the attacker can operate as a guest user, this increases the risk of unauthorized data access or manipulation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected endpoints if possible, and implement input validation and parameterized queries to mitigate SQL Injection risks.