This vulnerability affects code-projects Vehicle Showroom Management System version 1.0. The issue is located in the /util/Login_check.php file where the ID parameter is not properly sanitized, enabling an attacker to perform SQL injection remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been documented, and the vendor has not provided remediation guidance.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of exploitation in the wild, but a public exploit exists which increases risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /util/Login_check.php. Code review and input validation improvements should be prioritized once a patch or update is released.