Which versions of PHP are affected by CVE-2026-5368?

CVE-2026-5368 is a critical SQL injection vulnerability in projectworlds Car Rental Project 1.0 that allows unauthenticated attackers to bypass login controls and access or modify sensitive database…

Is there a public PoC exploit available for CVE-2026-5368?

Yes, a public proof-of-concept exploit is available for CVE-2026-5368. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5368?

Within 24 hours: Identify all systems running projectworlds Car Rental Project 1.0 and immediately isolate internet-facing instances or restrict access via firewall rules to trusted networks only. Within 7 days: Contact projectworlds vendor for security advisory and patch timeline; if no patch is provided, evaluate alternative car rental management solutions. Within 30 days: If application remains in use, deploy web application firewall (WAF) rules to block SQL injection patterns in the 'uname' parameter and conduct full database audit for unauthorized access or modifications.

PHP CVE-2026-5368

Q: What is the CVSS score of CVE-2026-5368?

CVE-2026-5368 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18482 MEDIUM

SQL Injection (CWE-89)

2026-04-02 VulDB

PHP SQLi Car Rental Project Projectworlds

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 17:30 euvd

EUVD-2026-18482

Analysis Generated

Apr 02, 2026 - 17:30 vuln.today

CVE Published

Apr 02, 2026 - 17:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in projectworlds Car Rental Project 1.0 login.php allows unauthenticated remote attackers to bypass authentication, extract sensitive database contents, and potentially modify or delete data via the 'uname' parameter. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network-accessible attack vector, no authentication requirement, and public exploit makes this a practical threat for internet-facing deployments of this vulnerable application.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), commonly known as SQL injection. The affected component is projectworlds Car Rental Project version 1.0, a PHP-based web application for vehicle rental management. The /login.php endpoint's Parameter Handler fails to properly sanitize the 'uname' input field before incorporating it into SQL queries. This allows attackers to inject malicious SQL syntax that alters query logic, enabling unauthorized database access. Classic SQL injection vectors through login forms typically exploit weak input validation in authentication queries (e.g., SELECT * FROM users WHERE username='[input]'), allowing attackers to manipulate query conditions with payloads like ' OR '1'='1 to bypass authentication or use UNION-based injection to extract data from arbitrary tables. The CPE identifier cpe:2.3:a:projectworlds:car_rental_project:*:*:*:*:*:*:*:* confirms this is a third-party open-source project, likely deployed by small businesses or educational institutions without robust security review processes.

RemediationAI

No vendor-released patch identified at time of analysis. Projectworlds has not published an official security advisory or patched version per available references. Immediate mitigation requires implementing input validation and parameterized queries at the application level. Organizations should apply prepared statements or parameterized queries for all database interactions in /login.php, specifically sanitizing the 'uname' parameter using PHP's PDO prepared statements or MySQLi bind_param() functions. Temporary workaround: implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting /login.php (regex filtering for SQL metacharacters like ', --, UNION, SELECT in username fields), though this provides defense-in-depth rather than fixing root cause. For production systems, consider replacing this application with actively maintained alternatives that follow secure coding practices, as the lack of vendor response suggests abandoned or unmaintained software. Review database permissions to ensure web application accounts operate with least privilege (no DROP, CREATE, or administrative rights). Monitor authentication logs for suspicious login attempts with SQL syntax patterns. Refer to VulDB disclosure https://vuldb.com/vuln/354746 and researcher POC https://github.com/eqiya17/collection-of-vulnerabilities/issues/5 for technical details to inform remediation testing.