SQLi Found in Vehicle Showroom System (CVE-2026-6151)
The National Vulnerability Database (NVD) recently reported on CVE-2026-6151, highlighting a critical SQL injection vulnerability within code-projects Vehicle Showroom Management System version 1.0. This flaw, found in the /util/PaymentStatusFunction.php file, allows for remote exploitation by manipulating the CUSTOMER_ID argument.
With a CVSSv3.1 score of 7.3 (HIGH), this vulnerability is a significant concern. The NVD notes that an exploit has already been made public, meaning it’s not just theoretical; it’s actively weaponizable. The CWE classifications, CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)), confirm the nature of this classic, yet still highly effective, attack vector.
Related ATT&CK Techniques
🛡️ Detection Rules
6 rules · 5 SIEM formats6 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, and QRadar AQL.
Web Application Exploitation Attempt — CVE-2026-6151
Get this rule in your SIEM's native format — copy, paste, detect. No manual conversion.
6 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.
Get Detection Rules →Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6151 | SQLi | code-projects Vehicle Showroom Management System 1.0 |
| CVE-2026-6151 | SQLi | CWE-89 |
| CVE-2026-6151 | SQLi | Vulnerable file: /util/PaymentStatusFunction.php |
| CVE-2026-6151 | SQLi | Vulnerable parameter: CUSTOMER_ID |
Related Posts
Critical RCE Flaw Hits NuGet Gallery Backend
CVE-2026-39399 — NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within...
BoidCMS LFI to RCE: A Critical Template Flaw
CVE-2026-39387 — BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are...
Nanobot AI: WebSocket Hijack Puts WhatsApp Sessions at Risk
CVE-2026-35589 — nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server...