Which versions of PHP are affected by CVE-2026-6152?

An unauthenticated SQL injection vulnerability in code-projects Vehicle Showroom Management System 1.0 allows remote attackers to read, modify, or delete database contents, directly compromising data…

Is there a public PoC exploit available for CVE-2026-6152?

Yes, a public proof-of-concept exploit is available for CVE-2026-6152. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6152?

Within 24 hours: Identify all instances of Vehicle Showroom Management System 1.0 in production and isolate them from untrusted networks. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting /util/StaffAddingFunction.php and the STAFF_ID parameter; enable database access logging and alerts. Within 30 days: Contact vendor for patch timeline or evaluate migration to alternative vehicle management solutions; conduct full database audit for unauthorized modifications.

PHP CVE-2026-6152

Q: What is the CVSS score of CVE-2026-6152?

CVE-2026-6152 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21778 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

GHSA-6j66-5hmg-2xj7

PHP SQLi Vehicle Showroom Management System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 03:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 02:50 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 02:45 euvd

EUVD-2026-21778

Analysis Generated

Apr 13, 2026 - 02:45 vuln.today

CVE Published

Apr 13, 2026 - 02:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddingFunction.php. This manipulation of the argument STAFF_ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the STAFF_ID parameter in /util/StaffAddingFunction.php. CVSS score of 7.3 (High) reflects network-accessible attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), significantly lowering exploitation barrier, though no active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) affecting a PHP-based web application. The affected product, Vehicle Showroom Management System 1.0 by code-projects (CPE 2.3:a:code-projects:vehicle_showroom_management_system:*), fails to properly sanitize the STAFF_ID parameter in the StaffAddingFunction.php endpoint. SQL injection occurs when user-controllable input is concatenated directly into SQL queries without parameterization or escaping, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands. The /util/ directory path suggests this is an administrative or utility function, potentially handling staff management operations. The vulnerability enables manipulation of backend database queries, which in this case provides unauthorized access to confidential data (C:L), ability to modify integrity (I:L), and potentially disrupt availability (A:L) according to the CVSS impact metrics.

RemediationAI

No vendor-released patch identified at time of analysis for code-projects Vehicle Showroom Management System 1.0. The vendor (code-projects.org) has not published a security advisory or patched version according to available references. Immediate mitigation steps: (1) Implement input validation and parameterized queries (prepared statements) for the STAFF_ID parameter in /util/StaffAddingFunction.php using PHP PDO or mysqli prepared statement APIs. (2) Apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting this endpoint, focusing on patterns matching single quotes, SQL keywords (UNION, SELECT, OR, AND), and comment sequences. (3) Restrict network access to /util/ directory to trusted IP ranges or authenticated administrative sessions only via web server configuration (Apache .htaccess or nginx location blocks). (4) Enable database query logging to detect exploitation attempts. (5) Review all other PHP files in the application for similar unsanitized parameter usage, as code quality issues in open-source projects often cluster. (6) Consider migrating to a commercially supported vehicle management platform if vendor responsiveness remains absent. Consult VulDB advisory at https://vuldb.com/vuln/357032 and GitHub POC at https://github.com/zheng-lv/CVE-/issues/3 for technical exploitation details to inform defensive measures.