This vulnerability affects code-projects Vehicle Showroom Management System 1.0 and involves an SQL injection via the STAFF_ID parameter in the /util/StaffAddingFunction.php file. An attacker can remotely exploit this flaw without privileges or user interaction, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required. No official fix or patch has been documented, and the vulnerability state is published with public disclosure of the exploit details.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database privileges of the application. The vulnerability does not require authentication or user interaction, increasing the risk of remote exploitation. However, the overall severity is medium, reflecting some limitations in impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the STAFF_ID parameter to mitigate SQL injection risks. Monitoring for unusual database queries and restricting database permissions for the application may also reduce potential impact. No official remediation or temporary fix has been provided by the vendor as of now.