EUVD-2026-41743
GHSA-cmxf-6jmj-h7h4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires no authentication (PR:N, AV:N); limited C/I/A (L each) reflects partial data exposure via SQLi without confirmed full system compromise across all deployments.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Smart Parking System 1.0 exposes the /parkings/parkings.php endpoint to remote unauthenticated exploitation via unsanitized street, city, and status parameters. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required. A public proof-of-concept has been disclosed via a Medium article specifically documenting escalation from SQL injection to arbitrary file read, materially increasing real-world risk beyond the moderate base score of 5.5.
Technical ContextAI
The affected application is a PHP-based web system (code-projects Smart Parking System 1.0) that passes user-supplied input from the street, city, and status HTTP parameters directly into SQL queries within /parkings/parkings.php without parameterization or sanitization. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) is the root cause class, encompassing SQL injection as a subtype. The public POC documented on Medium specifically demonstrates escalation to arbitrary file read, which in MySQL/MariaDB contexts requires the database user to hold the FILE privilege - enabling functions like LOAD_FILE() or SELECT ... INTO OUTFILE. No CPE string was provided in the input data. The application is PHP-based per the VulDB tags, and the vendor product page is listed at https://code-projects.org/.
RemediationAI
No vendor-released patch has been identified at time of analysis. Developers should immediately refactor /parkings/parkings.php to use PDO or MySQLi prepared statements with bound parameters for all three affected input fields (street, city, status), which is the definitive fix. As an immediate compensating control, deploy a web application firewall (WAF) rule blocking SQL metacharacters (single quotes, comment sequences, UNION/SELECT keywords) in those parameters - note this may reject legitimate search inputs containing apostrophes. Restrict network access to the parking management interface to trusted IP ranges where possible. If the MySQL/MariaDB user account holds the FILE privilege, revoke it immediately (REVOKE FILE ON *.* FROM 'user'@'host') to neutralize the arbitrary file read escalation path documented in the public POC; this has no functional impact on normal parking system operation. Reference: https://vuldb.com/vuln/376317 and https://medium.com/@avdzav10/sql-injection-leading-to-arbitrary-file-read-in-smart-parking-system-php-2cd5b084f9e1.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today