This vulnerability involves an SQL injection flaw in the Vehicle Showroom Management System 1.0 by code-projects. Specifically, the issue is located in the /util/BookVehicleFunction.php file, where the BRANCH_ID parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official fix or patch has been published as of the current information.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. Since the vulnerability is remotely exploitable without authentication, it increases the risk of compromise. However, the overall severity is medium, reflecting some limitations in impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable functionality, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the BRANCH_ID parameter, and reviewing input validation controls. Monitor vendor channels for updates and patches.