This vulnerability affects code-projects Vehicle Showroom Management System version 1.0. It arises from improper handling of the BRANCH_ID parameter in the /util/RegisterCustomerFunction.php file, enabling an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or fix has been disclosed, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should consider restricting access to the vulnerable functionality and validate or sanitize inputs to the BRANCH_ID parameter as a temporary mitigation. Monitor vendor channels for updates regarding patches or official mitigations.