This vulnerability in code-projects Vehicle Showroom Management System 1.0 allows remote attackers to perform SQL injection by manipulating the BRANCH_ID parameter in the /util/MonthTotalReportUpdateFunction.php file. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. The vulnerability is publicly known but no vendor fix or mitigation has been documented.

Successful exploitation can lead to unauthorized SQL queries on the backend database, potentially exposing or altering data. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. Since the attack can be performed remotely without authentication, it poses a significant risk to systems running the vulnerable version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality or applying input validation and sanitization on the BRANCH_ID parameter to mitigate exploitation risk.