This vulnerability affects code-projects Vehicle Showroom Management System 1.0. An attacker can exploit improper input validation of the BRANCH_ID parameter in the /util/AddVehicleFunction.php file to inject malicious SQL commands. The attack vector is network-based and requires no privileges or user interaction. The vulnerability has been publicly disclosed, but there is no vendor-provided patch or official remediation at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the BRANCH_ID parameter.