Which versions of PHP are affected by CVE-2026-6148?

CVE-2026-6148 is a critical SQL injection vulnerability in Vehicle Showroom Management System 1.0 that allows unauthenticated attackers to directly access, modify, or delete the entire database…

Is there a public PoC exploit available for CVE-2026-6148?

Yes, a public proof-of-concept exploit is available for CVE-2026-6148. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6148?

Within 24 hours: Immediately audit network access logs for MonthTotalReportUpdateFunction.php requests and identify all instances of Vehicle Showroom Management System 1.0 on your network and internet perimeter. Within 7 days: Isolate affected systems from internet access via firewall rules blocking external traffic to the application, or take systems offline if critical business function permits. Contact the vendor for timeline to available patch or security update. Within 30 days: Implement database access controls, conduct forensic analysis of logs and backups to identify unauthorized access or data exfiltration, and migrate to a patched version or replacement system when available.

PHP CVE-2026-6148

Q: What is the CVSS score of CVE-2026-6148?

CVE-2026-6148 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21774 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-v36w-f92j-7386

PHP SQLi Vehicle Showroom Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 02:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 02:04 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 02:00 euvd

EUVD-2026-21774

Analysis Generated

Apr 13, 2026 - 02:00 vuln.today

CVE Published

Apr 13, 2026 - 01:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the BRANCH_ID parameter in MonthTotalReportUpdateFunction.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no user interaction required. CVSS 7.3 reflects network-accessible attack with low complexity and no authentication barrier, creating immediate risk for internet-exposed instances.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected file MonthTotalReportUpdateFunction.php fails to properly sanitize or parameterize the BRANCH_ID input parameter before incorporating it into SQL queries. SQL injection occurs when user-controlled data is concatenated directly into SQL statements without validation or escaping, allowing attackers to inject malicious SQL commands. The CPE identifier (cpe:2.3:a:code-projects:vehicle_showroom_management_system) indicates this affects code-projects' Vehicle Showroom Management System, a likely open-source or freely distributed application for automotive dealership management. The vulnerability resides in reporting functionality that processes monthly total reports, suggesting the affected database likely contains business-critical sales, inventory, or customer data.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running Vehicle Showroom Management System 1.0 should immediately implement compensatory controls. Primary mitigation: implement parameterized queries (prepared statements) in MonthTotalReportUpdateFunction.php to properly handle the BRANCH_ID parameter, ensuring user input is treated as data rather than executable SQL code. Secondary mitigations include input validation using allowlists (e.g., restricting BRANCH_ID to expected integer values), web application firewall (WAF) rules to detect SQL injection patterns in requests to the affected endpoint, and network segmentation to restrict access to the application from trusted IP ranges only. If the monthly reporting functionality is non-critical, consider disabling or restricting access to MonthTotalReportUpdateFunction.php until a secure code fix is deployed. Monitor VulDB advisory (https://vuldb.com/vuln/357028) and code-projects.org for official patches. Review database logs for indicators of exploitation attempts targeting this parameter. Given the public POC availability (https://github.com/mrpgi/cve/issues/2), treat this as an emergency-priority remediation for any internet-facing deployments.