This vulnerability affects code-projects Vehicle Showroom Management System 1.0. It arises from improper sanitization of the CUSTOMER_ID parameter in the /util/PaymentStatusFunction.php file, enabling remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. Exploit code is publicly available, increasing the risk of exploitation. No official fix or patch has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the Vehicle Showroom Management System. The CVSS vector indicates low confidentiality, integrity, and availability impacts, but the presence of public exploit code increases the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing input validation or parameterized queries to mitigate the risk. Monitoring for unusual database activity and restricting access to the vulnerable endpoint may also reduce exposure until a vendor patch is released.