What is the CVSS score of CVE-2026-37342?

CVE-2026-37342 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-37342?

SourceCodester Vehicle Parking Area Management System v1.0 contains a SQL injection vulnerability in the parking details view that allows authenticated administrators to compromise the entire…

How to fix or mitigate CVE-2026-37342?

Within 24 hours: Inventory all instances of SourceCodester Vehicle Parking Area Management System v1.0 in production and identify users with administrative credentials. Within 7 days: Restrict administrative account access to only essential personnel and implement database activity monitoring on the affected application. Within 30 days: Evaluate replacement with a maintained alternative or engage vendor for custom remediation, as no patch is available; do not continue production use of v1.0 without compensating controls in place.

PHP CVE-2026-37342

EUVD-2026-23256 HIGH

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-3fcv-p6qc-8gvx

PHP SQLi

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 03:23 vuln.today

CVSS changed

Apr 18, 2026 - 03:22 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23256

Analysis Generated

Apr 16, 2026 - 15:22 vuln.today

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 7.2

DescriptionCVE.org

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.

AnalysisAI

SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL commands via the /parking/view_parked_details.php endpoint. The vulnerability requires administrative credentials (CVSS PR:H) but enables full database compromise once authenticated. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. A public proof-of-concept exists on GitHub, lowering the technical barrier for authenticated attackers.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The flaw exists in the view_parked_details.php script, which likely constructs SQL queries using unsanitized user input from GET or POST parameters. SQL injection occurs when user-controlled data is concatenated directly into SQL statements without proper parameterization or escaping, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands. The parking management context suggests the vulnerable parameter may relate to vehicle IDs, parking slot identifiers, or date/time filters used to retrieve parked vehicle details. PHP applications commonly use mysqli or PDO database extensions; vulnerable code typically resembles direct string concatenation like 'SELECT * FROM parked WHERE id=' . $_GET['id'] instead of prepared statements.

RemediationAI

No vendor-released patch or fixed version has been identified in available advisories at time of analysis. For organizations operating SourceCodester Vehicle Parking Area Management System v1.0, immediate remediation requires code-level fixes: refactor /parking/view_parked_details.php to use parameterized queries (prepared statements) for all database interactions, replacing any string concatenation of user inputs into SQL. If source code modification is not immediately feasible, implement compensating controls: (1) restrict access to /parking/view_parked_details.php to only the minimum required high-privilege accounts via web server ACLs or application-layer authorization hardening, accepting that this reduces functionality, (2) deploy a web application firewall (WAF) with SQLi signature detection to block common injection patterns in requests to this endpoint, noting this is bypassable and creates false positive risk, (3) enable database query logging and monitor for anomalous SQL statements from the application account, which adds detection capability but not prevention. The GitHub POC at https://github.com/mt-0505/cve-report/blob/main/sourcecodester/vehicle-parking-area-management-system/SQL-2.md should be reviewed to understand exact exploitation vectors. Given this appears to be unmaintained open-source software, consider migrating to actively maintained parking management solutions with vendor security support.