Which versions of PHP are affected by CVE-2026-6151?

CVE-2026-6151 is a critical SQL injection vulnerability in Vehicle Showroom Management System 1.0 that allows unauthenticated attackers to compromise database integrity through the payment processing…

Is there a public PoC exploit available for CVE-2026-6151?

Yes, a public proof-of-concept exploit is available for CVE-2026-6151. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6151?

Within 24 hours: Inventory all deployments of Vehicle Showroom Management System 1.0 and isolate affected systems from production networks or disable public access to /util/PaymentStatusFunction.php. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the CUSTOMER_ID parameter; conduct database audit for unauthorized modifications. Within 30 days: Either upgrade to a patched version (when released by vendor) or migrate to an alternative showroom management solution; if neither feasible, maintain compensating controls indefinitely.

PHP CVE-2026-6151

Q: What is the CVSS score of CVE-2026-6151?

CVE-2026-6151 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21780 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-h3wr-fr68-rf69

PHP SQLi Vehicle Showroom Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 03:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 02:50 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 02:45 euvd

EUVD-2026-21780

Analysis Generated

Apr 13, 2026 - 02:45 vuln.today

CVE Published

Apr 13, 2026 - 02:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/PaymentStatusFunction.php. The manipulation of the argument CUSTOMER_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database records via the CUSTOMER_ID parameter in /util/PaymentStatusFunction.php. CVSS 7.3 (High) with low attack complexity and no authentication required. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation. No vendor-released patch identified at time of analysis, creating an urgent risk for exposed deployments.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The vulnerable endpoint /util/PaymentStatusFunction.php fails to properly sanitize or parameterize the CUSTOMER_ID input parameter before incorporating it into SQL queries. SQL injection occurs when user-controlled data is concatenated directly into SQL statements without validation, allowing attackers to inject arbitrary SQL commands. The affected product, code-projects Vehicle Showroom Management System 1.0 (CPE: cpe:2.3:a:code-projects:vehicle_showroom_management_system:1.0), appears to be an open-source or freely distributed PHP application for managing vehicle sales and customer records. The vulnerability's location in a payment status function suggests the SQL query likely retrieves or updates customer payment information, making this a high-value target for attackers seeking financial data or customer personally identifiable information.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations must implement immediate compensatory controls: (1) If the application is internet-facing, place it behind a web application firewall (WAF) with SQL injection signatures enabled and rule sets tuned to block malicious CUSTOMER_ID parameter patterns. (2) Restrict network access to the /util/PaymentStatusFunction.php endpoint to trusted IP ranges only via firewall rules or .htaccess. (3) Review application logs for suspicious CUSTOMER_ID values containing SQL metacharacters (quotes, semicolons, UNION, SELECT keywords). (4) If source code access is available, implement emergency hotfix by replacing vulnerable SQL query with parameterized prepared statements (PDO or MySQLi with bound parameters in PHP). (5) Monitor vendor advisory channels at code-projects.org and VulDB (https://vuldb.com/vuln/357031) for official patch releases. (6) Consider migrating to a commercially supported vehicle management system with active security maintenance if vendor does not respond. Long-term remediation requires eliminating this entire class of vulnerability through code review and adoption of secure coding practices including input validation, output encoding, and mandatory use of parameterized queries throughout the application.