Which versions of PHP are affected by CVE-2026-5637?

CVE-2026-5637 is a critical SQL injection vulnerability in projectworlds Car Rental System 1.0 that allows unauthenticated attackers to execute arbitrary database commands through the administrative…

Is there a public PoC exploit available for CVE-2026-5637?

Yes, a public proof-of-concept exploit is available for CVE-2026-5637. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5637?

Within 24 hours: Identify all instances of projectworlds Car Rental System 1.0 in production and development environments; isolate affected systems from public network access or disable the /message_admin.php endpoint via web application firewall rules. Within 7 days: Contact projectworlds vendor for patch availability timeline; if no patch is imminent, evaluate alternative car rental management systems or implement compensating controls. Within 30 days: Deploy patched version once available, or execute full replacement of the affected application.

PHP CVE-2026-5637

Q: What is the CVSS score of CVE-2026-5637?

CVE-2026-5637 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19203 MEDIUM

SQL Injection (CWE-89)

2026-04-06 VulDB

GHSA-f92h-cvpr-77r6

PHP SQLi Car Rental System Projectworlds

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 09:00 euvd

EUVD-2026-19203

Analysis Generated

Apr 06, 2026 - 09:00 vuln.today

CVE Published

Apr 06, 2026 - 08:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in projectworlds Car Rental System 1.0. This vulnerability affects unknown code of the file /message_admin.php of the component Parameter Handler. Such manipulation of the argument Message leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Message parameter in /message_admin.php. Publicly available exploit code exists, significantly lowering the barrier to exploitation. The vulnerability enables unauthorized data access, modification, and potential denial of service against the administrative messaging interface. CVSS 7.3 severity reflects network-accessible attack vector with low complexity and no authentication requirement.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The Car Rental System's Parameter Handler component fails to properly sanitize user input from the 'Message' parameter before incorporating it into SQL queries executed by the /message_admin.php endpoint. SQL injection occurs when untrusted data is concatenated directly into SQL statements without parameterization or adequate escaping, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands. The affected product is identified by CPE cpe:2.3:a:projectworlds:car_rental_system:1.0, indicating this is version 1.0 of the Car Rental System developed by projectworlds. The administrative messaging component appears to lack fundamental input validation, a critical security control for web applications handling user-supplied data in database operations.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running projectworlds Car Rental System 1.0 should immediately implement defensive measures: disable or restrict access to /message_admin.php to trusted IP addresses only via web server configuration (Apache .htaccess or nginx location blocks); implement a web application firewall (WAF) with SQL injection signatures to filter malicious Message parameter input; conduct code review of the Parameter Handler component and implement parameterized queries (prepared statements) using PDO or mysqli prepared statement APIs instead of string concatenation for SQL query construction. Long-term remediation requires modifying the source code to use parameterized queries: replace all instances where the Message parameter is concatenated into SQL strings with PDO::prepare() and bindParam() methods. Consult VulDB references for technical details: https://vuldb.com/vuln/355425 and exploit proof-of-concept at https://github.com/eqiya17/collection-of-vulnerabilities/issues/13. Consider migrating to actively maintained car rental management software with established security practices if projectworlds no longer maintains this product.