Das Parking Management System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in Das Parking Management System version 6.2.0. The issue arises in the API component, specifically within the '/vehicle/search' endpoint. The vulnerability allows for unauthorized access by manipulating the 'vehicleTypeCode' argument, leading to the injection of malicious SQL code. This exploitation can be performed remotely, without the need for authentication, potentially allowing attackers to access sensitive user data.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data modification, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the '/vehicle/search' API endpoint with a crafted 'vehicleTypeCode' argument that includes SQL injection payloads. The absence of authentication requirements allows this attack to be executed by any user.