The Vehicle Showroom Management System version 1.0 contains a SQL injection vulnerability in the /util/UpdateVehicleFunction.php file. Specifically, the VEHICLE_ID parameter is not properly sanitized, enabling remote attackers to inject malicious SQL code. This could potentially allow unauthorized access or modification of the backend database. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No official fix or patch has been published as of the current information.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The CVSS score of 6.9 indicates a medium severity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to mitigate SQL injection risks related to the VEHICLE_ID parameter. Monitor vendor channels for updates or patches addressing this vulnerability.