The Vehicle Showroom Management System 1.0 from code-projects contains an SQL injection vulnerability in the /util/PaymentStatusFunction.php file. The issue arises from improper sanitization of the CUSTOMER_ID argument, allowing an attacker to inject malicious SQL commands remotely. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or patch has been published, and the exploit code is publicly available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality and integrity of the system's data. However, the vulnerability has a medium severity rating and no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts.