The Vehicle Showroom Management System version 1.0 contains an SQL injection vulnerability in the /util/BookVehicleFunction.php file. An attacker can manipulate the BRANCH_ID parameter to inject SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and validate or sanitize input parameters such as BRANCH_ID to mitigate injection risks.