EUVD-2026-21776Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Affected by this issue is some unknown functionality of the file /util/BookVehicleFunction.php. Executing a manipulation of the argument BRANCH_ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
AnalysisAI
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the BRANCH_ID parameter in /util/BookVehicleFunction.php. The vulnerability has publicly available exploit code (GitHub POC), enabling trivial exploitation with low attack complexity. CVSS 7.3 reflects medium-severity impacts across confidentiality, integrity, and availability. No vendor patch has been identified at time of analysis.
Technical ContextAI
This vulnerability affects code-projects Vehicle Showroom Management System 1.0, a PHP-based web application for managing vehicle inventory and bookings. The flaw is a classic CWE-89 SQL injection in the BookVehicleFunction.php endpoint, where user-supplied input from the BRANCH_ID parameter is incorporated into SQL queries without proper sanitization or parameterization. SQL injection occurs when attackers craft malicious SQL statements that break out of intended query logic, allowing arbitrary database commands. In PHP applications without prepared statements or input validation, attackers can append SQL metacharacters (e.g., single quotes, UNION operators, comment sequences) to parameters passed via GET/POST requests. The CPE identifier (cpe:2.3:a:code-projects:vehicle_showroom_management_system:*:*:*:*:*:*:*:*) confirms the affected product as a code-projects.org offering, a platform known for hosting educational and small-scale PHP projects that often lack enterprise security hardening.
RemediationAI
No vendor-released patch identified at time of analysis for Vehicle Showroom Management System 1.0. Organizations must implement immediate workarounds: (1) Apply input validation and parameterized queries (prepared statements) to the BRANCH_ID parameter in /util/BookVehicleFunction.php - replace all dynamic SQL concatenation with PDO or MySQLi prepared statements in the PHP codebase. (2) Deploy a web application firewall (WAF) with SQL injection signatures to block exploitation attempts targeting this endpoint. (3) Restrict network access to the management system using IP allowlisting or VPN requirements to reduce attack surface. (4) Conduct a comprehensive code audit of all user-input handling across the application, as similar flaws likely exist in other endpoints. (5) Monitor the code-projects.org repository and VulDB advisories (https://vuldb.com/vuln/357029) for future patches, though vendor response for educational projects is historically inconsistent. If the application is non-critical, consider migrating to a maintained commercial alternative with active security support.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today