CVE-2026-6165
SQL Injection in Vehicle Showroom Management System Login_check.php
Publication date: 2026-04-13
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Vehicle Showroom Management System 1.0 allows attackers to gain unauthorized access to the database, potentially leading to data leakage, tampering, or deletion. Such unauthorized access and data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining data integrity and confidentiality.
Failure to remediate this vulnerability could result in violations of data protection requirements, exposing the organization to legal and regulatory penalties, as well as loss of trust from customers and stakeholders.
Recommended remediation steps such as using prepared statements, input validation, minimizing database user permissions, and regular security audits are essential to secure the system and help maintain compliance with these standards.
Can you explain this vulnerability to me?
This vulnerability is a SQL injection flaw found in the Vehicle Showroom Management System 1.0, specifically in the file /util/Login_check.php. It occurs because the 'id' parameter is used directly in SQL queries without proper input validation or sanitization.
Attackers can exploit this by injecting malicious SQL code through the 'id' parameter, which allows them to manipulate database queries remotely without needing to authenticate.
Different SQL injection techniques can be used, including boolean-based blind, error-based, and time-based blind SQL injection, enabling attackers to extract or manipulate database information.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to the database, leakage of sensitive data, tampering with or deletion of data, and potentially taking full control of the system.
It can also cause service disruptions, affecting the availability and reliability of the Vehicle Showroom Management System.
Since no authentication is required to exploit this vulnerability, attackers can easily launch attacks remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by testing the vulnerable parameter 'id' in the /util/Login_check.php file for injection flaws.
- Use boolean-based blind SQL injection payloads such as: id=admin' AND 9071=9071 AND 'Tjcj'='Tjcj
- Use error-based SQL injection payloads exploiting MySQL functions like CONCAT and FLOOR(RAND(0)*2).
- Use time-based blind SQL injection payloads with the SLEEP function to infer database behavior.
- Use automated tools like sqlmap to test and confirm the presence of the SQL injection vulnerability and extract database information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Implement prepared statements with parameter binding to separate SQL code from user input and prevent injection.
- Apply strict input validation and filtering to ensure inputs conform to expected formats.
- Minimize database user permissions by avoiding use of high-privilege accounts such as root or admin for routine operations.
- Conduct regular security audits of code and systems to detect and fix vulnerabilities promptly.