Description

A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T13:20:11.470Z",
  "pubdate": "2026-09-04T13:20:11.470Z",
  "executiveSummary": "The Vehicle Management System 1.0 is affected by a critical SQL injection vulnerability located within the /busprofile.php file. This vulnerability arises from improper sanitization of user-supplied input provided via the 'busid' argument, allowing an unauthenticated remote attacker to manipulate database queries.\nSuccessful exploitation enables unauthorized interaction with the backend database, potentially leading to data exfiltration, unauthorized modification of records, or complete database compromise. Because the vulnerability is remotely exploitable and public exploit code exists, the risk to confidentiality, integrity, and availability is considered high. Organizations deploying this software should consider the system compromised unless immediate remediation steps are taken to sanitize input and isolate affected modules.",
  "technicalDetails": "The vulnerability is identified as a classic SQL injection flaw where the application fails to adequately validate or parameterize the 'busid' argument before incorporating it into a database query within /busprofile.php. This failure allows an attacker to inject arbitrary SQL commands into the application's database layer, effectively subverting the logic of the intended query.\nThe attack flow initiates when a remote user sends a crafted HTTP GET or POST request targeting /busprofile.php with a manipulated 'busid' parameter. The application processes this input without using parameterized queries (prepared statements) or rigorous input validation, thereby concatenating the malicious payload directly into the SQL string executed by the database management system (DBMS).\nUpon execution, the injected SQL code is parsed and executed by the backend database with the privileges of the database service account. This allows the attacker to manipulate the query structure, such as appending 'UNION SELECT' statements to extract data from sensitive tables, bypassing authentication mechanisms, or executing administrative commands depending on the database configuration and underlying user permissions.\nSince the affected endpoint, /busprofile.php, is accessible remotely, an attacker does not require prior authentication or elevated privileges to execute the attack. The existence of public exploit code lowers the barrier to entry, enabling automated scanning and exploitation by threat actors. Post-exploitation impact is severe, as the attacker can perform unauthorized CRUD operations on the system database, including the retrieval of user credentials, administrative configurations, and core business data maintained by the Vehicle Management System 1.0.\nThe root cause is the reliance on insecure coding practices regarding data handling, specifically the lack of input sanitization and the absence of parameterized query interfaces (e.g., PDO in PHP) to handle dynamic user input. Because the specific function responsible is currently unknown, all database interactions within /busprofile.php should be treated as high-risk entry points."
}