CVE-2024-48245
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
Vehicle Management System 1.0 is vulnerable to SQL injection. An unauthenticated user can exploit POST parameters in administrative actions such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID" in /newvehicle.php and /newdriver.php.
Risk Assessment
An attacker can gain unauthorized access to the database, steal sensitive data (e.g., customer information, payment details), or modify system content, leading to a breach of data confidentiality and integrity.
Recommendation
Immediately update the software to the latest version or apply a security patch. In the meantime, validate and sanitize all input data and use prepared statements in PHP code.
Other vulnerabilities in Vehicle Management System
See all- CVE-2026-85517Medium
A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
- CVE-2026-85516High
Vehicle Management System 1.0 by code-projects contains an SQL injection vulnerability in the file /busprofile.php. Manipulation of the busid argument allows remote execution of SQL queries.
Original NVD description (English source)
Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which are present in /newvehicle.php and /newdriver.php.