This vulnerability affects code-projects Vehicle Showroom Management System version 1.0. It arises from improper sanitization of the BRANCH_ID parameter in the /util/RegisterCustomerFunction.php file, allowing an attacker to perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly known and exploitable, but no official remediation or patch has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There are no confirmed reports of exploitation in the wild, but publicly available exploits increase the risk of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should consider implementing input validation or filtering on the BRANCH_ID parameter as a temporary mitigation. Monitoring for unusual database queries and restricting access to the vulnerable endpoint may also help reduce risk until a vendor patch is released.