EUVD-2025-19531Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /book_car.php with malicious fname value
-
ExploitSQL injection payload alters query logic
-
ImpactExtract or modify database records with low privilege impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Car Rental System 1.0 via the /book_car.php endpoint. The vulnerable 'fname' parameter does not require authentication and is exposed by default. No additional features need to be enabled; the attack complexity is low. |
| Impact | CVSS 4.0 base metrics (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicate a low impact on confidentiality, integrity, and availability, yielding a score of 5.5. EPSS predicts a 0.04% chance of exploitation, placing it in the 13th percentile and suggesting minimal real-world risk. No KEV listing or evidence of active exploitation exists, and the 'critical' tag in the description overstates the threat. A manual CVSS 3.1 rating (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) gives a base score of 7.3, but the limited impact and low EPSS indicate true risk is low. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the publicly accessible /book_car.php endpoint, injecting malicious SQL syntax through the 'fname' parameter. The injection allows data exfiltration (e.g., user credentials) or limited data manipulation, depending on the underlying database user's rights. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
RemediationAI
No vendor-released patch exists at the time of analysis. As a workaround, apply input validation and sanitization on the 'fname' parameter, use prepared statements with parameterized queries, and restrict the database account privileges used by the application. Temporarily disable or restrict access to /book_car.php, for example, by requiring authentication or blocking external requests via web server rules. Note that disabling the file may break core booking functionality, so a code fix is preferred in the long term.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the PHP file /book_car.php, where the 'fname' argument is passed unsafely to a SQL query without proper sanitization or parameterized statements. This leads to a classic SQL injection, classified under CWE-74 (improper neutralization of special elements in output used by a downstream component), though it is often mapped to CWE-89. The affected product, Car Rental System 1.0 by anisha, is identified by CPE cpe:2.3:a:anisha:car_rental_system:1.0 and is written in PHP, likely using a relational database backend.
Know when Car Rental System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible, no privileges required, low impact on confidentiality, integrity, and availability due to limited injection scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability classified as critical was found in code-projects Car Rental System 1.0. This vulnerability affects unknown code of the file /book_car.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Car Rental System
View allCar Rental System v1.0 was discovered to contain a SQL injection vulnerability at /Car_Rental/booking.php via the id par
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Rated medium severity (CV
CVE-2025-6579 is a critical SQL injection vulnerability in code-projects Car Rental System 1.0 affecting the /message_ad
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to e
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, un
SQL injection in Car Rental System 1.0 (PHP) allows manipulation of the /admin/approve.php endpoint by supplying a malic
SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to manipulate database quer
SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL co
A vulnerability was found in CodeAstro Car Rental System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is re
Unrestricted file upload in code-projects Car Rental System 1.0 allows remote attackers to upload arbitrary files via th
A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Rated medium sever
Exploit-DB