The Vehicle Showroom Management System version 1.0 contains a SQL injection vulnerability in an unspecified function within /util/AddVehicleFunction.php. By manipulating the BRANCH_ID parameter, an attacker can inject SQL commands remotely without requiring privileges or user interaction. This vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized access or modification of the database. The impact on confidentiality, integrity, and availability is rated as low to limited, consistent with the CVSS vector. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for vendor updates. In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the BRANCH_ID parameter. Avoid exposing the vulnerable endpoint publicly if possible.