This vulnerability involves SQL injection in the Vehicle Showroom Management System 1.0 by code-projects. Specifically, the issue arises from improper sanitization or validation of the VEHICLE_ID argument in a function located in /util/VehicleDetailsFunction.php. An attacker can remotely exploit this flaw to inject malicious SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been documented, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. The CVSS score and vector indicate limited impact on confidentiality, integrity, and availability, but the presence of public exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitor for updates from the vendor or trusted security sources to apply an official fix once released.