The Vehicle Showroom Management System version 1.0 contains a SQL injection vulnerability in the /util/MonthTotalReportUpdateFunction.php file. Specifically, the BRANCH_ID parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands remotely without any privileges or user interaction. This could potentially allow unauthorized access or modification of the backend database. The vulnerability is publicly known and exploitable, but no vendor-provided fix or mitigation details are currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database permissions and structure. The CVSS score of 6.9 reflects a medium severity impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the BRANCH_ID parameter. Additionally, reviewing and sanitizing input handling in the affected file may reduce risk. Monitor vendor channels for updates and patches.