This vulnerability involves an SQL injection in the Vehicle Showroom Management System 1.0 by code-projects. Specifically, the STAFF_ID parameter in a function located in /util/StaffDetailsFunction.php is vulnerable to injection attacks. An attacker can remotely manipulate this parameter to execute arbitrary SQL commands on the backend database. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation allows remote attackers to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited scope and impact metrics, indicating some constraints on the extent of compromise. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or parameterized queries as a temporary mitigation if possible. Monitoring for unusual database activity may help detect exploitation attempts.