The Vehicle Showroom Management System 1.0 by code-projects contains a SQL injection vulnerability in the /util/Login_check.php file. An attacker can remotely manipulate the ID parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Exploit code is publicly available, but no vendor patch or official remediation has been disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score and vector, with limited but non-negligible confidentiality, integrity, and availability impacts. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the ID parameter in /util/Login_check.php. Monitor for updates from the vendor regarding patches or official mitigations.