CVE-2026-6148: SQLi Hits Vehicle Showroom Management System
The National Vulnerability Database (NVD) recently detailed CVE-2026-6148, a high-severity SQL injection flaw impacting the code-projects Vehicle Showroom Management System, version 1.0. This vulnerability, rated 7.3 on the CVSS scale, stems from improper handling of the BRANCH_ID argument within the /util/MonthTotalReportUpdateFunction.php file.
What makes this particularly nasty is that the attack can be executed remotely, and an exploit is already public. This means the barrier to entry for attackers is effectively zero. A simple manipulation of the BRANCH_ID parameter is all it takes to trigger the SQL injection, potentially allowing unauthorized database access. The NVD notes CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) as contributing factors.
Related ATT&CK Techniques
🛡️ Detection Rules
6 rules · 5 SIEM formats6 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, and QRadar AQL.
Web Application Exploitation Attempt — CVE-2026-6148
Get this rule in your SIEM's native format — copy, paste, detect. No manual conversion.
6 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.
Get Detection Rules →Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6148 | SQLi | code-projects Vehicle Showroom Management System 1.0 |
| CVE-2026-6148 | SQLi | Vulnerable file: /util/MonthTotalReportUpdateFunction.php |
| CVE-2026-6148 | SQLi | Vulnerable argument: BRANCH_ID |
Related Posts
Critical RCE Flaw Hits NuGet Gallery Backend
CVE-2026-39399 — NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within...
BoidCMS LFI to RCE: A Critical Template Flaw
CVE-2026-39387 — BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are...
Nanobot AI: WebSocket Hijack Puts WhatsApp Sessions at Risk
CVE-2026-35589 — nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server...