EUVD-2026-21889
GHSA-34g8-8p3v-fxw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to UpdateVehicleFunction.php
-
DeliveryInject malicious SQL in VEHICLE_ID parameter
-
ExploitBypass input validation in PHP
-
ExecutionExecute arbitrary SQL on database
-
ImpactExfiltrate or modify vehicle data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.9 score with vector AV:N/AC:L/PR:N indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction-a high-friction attack surface. The E:P rating confirms exploitability is proven, and publicly available exploit code significantly reduces the barrier to weaponization. The scope is unchanged (S:X indicates no cross-boundary impact), but the confidentiality and integrity impacts (VC:L/VI:L) are non-negligible for a production system managing vehicle data. Real-world risk is substantial: any exposed instance is trivially compromisable by unauthenticated attackers, and the existence of public POC code on GitHub (referenced in the exploit link) means script-kiddies and opportunistic attackers can weaponize this immediately. This is not a low-risk high-CVSS artifact-it represents genuine, immediate exploitability. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts an HTTP request to /util/UpdateVehicleFunction.php with a malicious VEHICLE_ID parameter containing SQL injection payloads such as ' OR '1'='1 or UNION-based queries. The PHP application concatenates this unsanitized input directly into a SQL query without parameterization, allowing the attacker to extract sensitive vehicle data, modify database records, or potentially execute operating system commands if database permissions allow. Proof-of-concept code is publicly available on GitHub, enabling even low-skill attackers to reproduce the exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the VEHICLE_ID parameter in /util/UpdateVehicleFunction.php, achieving confidentiality and integrity compromise. Publicly available exploit code exists and the vulnerability carries a CVSS 6.9 score with confirmed exploitability (E:P rating).
RemediationAI
Immediate action required: update to a patched version of Vehicle Showroom Management System if available from code-projects. If no patched version is released, implement emergency mitigations including: (1) disable or restrict network access to /util/UpdateVehicleFunction.php via firewall or Web Application Firewall rules, (2) implement prepared statements and parameterized queries in the affected PHP code, (3) apply strict input validation and whitelisting to the VEHICLE_ID parameter to accept only expected formats (numeric IDs), and (4) review database user privileges to limit SQL injection impact scope. Consult https://code-projects.org/ for security updates and https://vuldb.com/vuln/357054 for detailed advisory information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based vehicle management application. The UpdateVehicleFunction.php file fails to properly sanitize or parameterize user input from the VEHICLE_ID parameter before incorporating it into SQL queries. The affected product is identified by CPE cpe:2.3:a:code-projects:vehicle_showroom_management_system:*:*:*:*:*:*:*:*, indicating all versions of the Vehicle Showroom Management System from code-projects are potentially vulnerable. Without parameterized queries or input validation, attackers can inject arbitrary SQL syntax to manipulate database operations.
Know when Vehicle Showroom Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/UpdateVehicleFunction.php. The manipulation of the argument VEHICLE_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows remote unauthenticated attackers to manipul
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to execute
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to read, m
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract
SQL injection in code-projects Vehicle Showroom Management System 1.0 allows unauthenticated remote attackers to extract
SQL injection in code-projects Vehicle Showroom Management System 1.0 via the BRANCH_ID parameter in /util/RegisterCusto
SQL injection in code-projects Vehicle Showroom Management System 1.0 exposes the `/util/AddVehicleFunction.php` endpoin
SQL injection in code-projects Vehicle Showroom Management System 1.0 exposes the VEHICLE_ID parameter in /util/VehicleD
Reflected cross-site scripting (XSS) in code-projects Vehicle Showroom Management System 1.0 allows remote attackers to
Reflected cross-site scripting (XSS) in code-projects Vehicle Showroom Management System 1.0 allows remote unauthenticat
Exploit-DB