CVE-2026-2867 is a high severity (CVSS 7.3) SQL injection in itsourcecode Vehicle Management System 1.0. The ID argument in billaction.php is not safely handled, and the exploit is public. The record lists no fixed version, so isolate the application or retire it.
What's affected
The record names Vehicle Management System 1.0 from itsourcecode. The affected function is in the file /billaction.php, and the vulnerable argument is ID.
There is no patched version in the record. Assume every instance is affected.
How to check if you're exposed
Look for the file on your servers:
find /var/www -name billaction.php 2>/dev/null
If it belongs to this project, you run the affected code. The VulDB entry has the report details.
What to do now
- Find all deployments of the application.
- Block public access, or allow only trusted networks.
- If you keep it, convert the billing query to a parameterized statement and review the database account's permissions.
- Check the database for unexpected changes.
- Watch VulDB and the vendor for a patched release.
Why it matters
This is CWE-89, SQL injection, in the injection class CWE-74. The ID parameter flows into a query without separation of data and command.
The record says the exploit has been disclosed publicly. It does not mark the CVE as exploited in the wild. For small unmaintained PHP projects the practical advice is the same each time: do not expose them, and replace them if the data matters.
Quick check
Can a web application firewall cover this?
It can add a layer, but it is not a fix. The reliable repair is to change the code to parameterized queries, which this project has not published.
Sources
Last reviewed: 19 October 2026.
