CVE-2026-6152
SQL Injection in Vehicle Showroom Management System StaffAddingFunction.php
Publication date: 2026-04-13
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | vehicle_showroom_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue found in the Vehicle Showroom Management System version 1.0, specifically in the file /util/StaffAddingFunction.php. It occurs because the STAFF_ID parameter is not properly validated or sanitized before being used in SQL queries.
Attackers can exploit this flaw by injecting malicious SQL code through the STAFF_ID parameter, which allows them to manipulate database queries remotely without needing any authentication.
Different SQL injection techniques such as Boolean-based blind injection, error-based injection, time-based blind injection, and UNION-based injection can be used to exploit this vulnerability.
How can this vulnerability impact me? :
Exploitation of this vulnerability can have severe impacts including unauthorized access to the database, leakage of sensitive information, alteration or deletion of data, and potentially taking full control of the system.
It can also lead to service disruptions and compromise the integrity and availability of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability in the Vehicle Showroom Management System 1.0 can be detected by testing the STAFF_ID parameter in the /util/StaffAddingFunction.php file for injection flaws.
Common detection methods include using payloads such as Boolean-based blind injection (e.g., STAFF_ID=-2274' OR 5423=5423#), error-based injection (e.g., STAFF_ID=111' OR (SELECT 9118 FROM(SELECT COUNT(*),CONCAT(...))a)--), time-based blind injection using SLEEP() (e.g., STAFF_ID=111' AND (SELECT 8555 FROM (SELECT(SLEEP(5)))bnuY)--), and UNION-based injection to extract data (e.g., STAFF_ID=111' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(...)).
The sqlmap tool can be used to automate detection and exploitation attempts against this parameter to confirm the vulnerability and enumerate the database.
- Use sqlmap with a command like: sqlmap -u "http://targetsite/util/StaffAddingFunction.php?STAFF_ID=1" --risk=3 --level=5 --dbs
- Manually test injection points by sending crafted HTTP requests with the above payloads in the STAFF_ID parameter and observe responses or delays.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps for this SQL injection vulnerability include:
- Implement prepared statements with parameter binding to separate SQL code from user input, preventing injection.
- Enforce strict input validation and filtering to ensure the STAFF_ID parameter conforms to expected formats and does not contain malicious input.
- Minimize database user privileges by avoiding the use of high-privilege accounts (such as root or admin) for routine database operations.
- Conduct regular security audits of the code and systems to detect and address vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Vehicle Showroom Management System allows attackers to gain unauthorized access to the database, potentially leading to leakage, alteration, or deletion of sensitive information.
Such unauthorized access and data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Failure to remediate this vulnerability could result in violations of these regulations due to inadequate data security controls, potentially leading to legal and financial consequences.