The Vehicle Showroom Management System 1.0 by code-projects contains an SQL injection vulnerability in the /util/StaffAddingFunction.php file. Specifically, the STAFF_ID argument is not properly sanitized, enabling remote attackers to inject malicious SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low attack complexity, and no privileges or user interaction required. No official fix or patch has been published as of the data available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database impacts. The vulnerability is remotely exploitable without authentication, increasing the risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to filter or block malicious STAFF_ID inputs. Monitoring for unusual database queries related to this parameter may also help detect exploitation attempts.