Car Rental System CVE-2025-6579

The CVSS 3.1 score of 7.3 reflects a HIGH severity vulnerability with the following vector components: AV:N (Network - remotely exploitable), AC:L (Low complexity - no special conditions needed), PR:N (No privileges required - unauthenticated access), UI:N (No user interaction required), S:U (Unchanged scope), C:L/I:L/A:L (Low impact on confidentiality, integrity, and availability). The combination of network accessibility and lack of authentication requirements significantly elevates real-world risk. Public disclosure and available POC code substantially increase exploitation probability. While CVSS rates this as HIGH (7.3) rather than CRITICAL (9.0+), the actual exploitation risk is substantial: SQL injection in web applications is trivially automatable, requires no user interaction, and can be chained with other attacks. From an SSVC perspective: exploitation is PUBLIC (POC available), impact is TECHNICAL (data breach potential), and the attack is AUTOMATABLE (SQL injection detection/exploitation is routine). This vulnerability warrants immediate patching despite the 7.3 CVSS score, as SQL injection in unauthenticated endpoints is consistently high-priority in real-world threat assessments.

An unauthenticated attacker identifies the publicly accessible /message_admin.php endpoint. Using publicly available SQL injection POC code or automated tools, they craft a malicious HTTP request containing SQL metacharacters in the Message parameter (e.g., Message=' OR '1'='1'; DROP TABLE users; --). Due to lack of input validation and authentication, this request is processed directly into a SQL query. The attacker successfully executes arbitrary SQL commands, such as: extracting customer databases (names, emails, payment information), modifying rental records, or deleting audit logs. The attack requires only a single HTTP POST/GET request and can be executed in seconds with no special tools beyond a basic HTTP client. Given public POC availability, this vulnerability likely has multiple attack tools and scripts circulating, making exploitation accessible to low-skill attackers.