Vehicle Management System CVE-2026-85517

No special conditions required beyond a live deployment of the application accessible over the network. The /vehicle_management.sql file must be present in the web server document root (the default installation state based on the PoC). No authentication, no elevated privileges, no user interaction, and no non-default configuration are needed. Exploitation is limited by: (1) the application must be internet- or network-reachable, (2) the SQL backup file must not have been manually removed or relocated post-installation, and (3) the web server must not have explicit deny rules for .sql files. The attack is fully automated and requires only knowledge of the file path, which is published in the PoC.

The CVSS 4.0 score of 6.9 with VC:L understates the practical impact; a full SQL dump exposes all table structures, stored credentials (potentially in cleartext or weakly hashed), vehicle owner PII, and any other application data, which arguably warrants VC:H in most deployment contexts. The E:P exploit modifier confirms a public PoC exists on GitHub, lowering the bar to exploitation to near-zero - any script kiddie can replicate the attack. No KEV listing, and EPSS data is not provided, but the trivial nature of the attack and public PoC increase realistic exploitation likelihood. Real-world risk is bounded primarily by the narrow deployment footprint: this is an educational demo project and is unlikely to be running in high-value production environments. However, any live deployment of this software exposes a full database dump to anyone who knows the file path.

An attacker discovers a live deployment of code-projects Vehicle Management System via a web search or directory enumeration tool. Using the published PoC as a reference, they issue a direct HTTP GET request to https://target.example.com/vehicle_management.sql and receive the complete database dump in response. The attacker extracts stored user credentials and PII, potentially using any plaintext or weakly hashed passwords to authenticate to the application or related accounts.