Which versions of PHP are affected by CVE-2026-5645?

CVE-2026-5645 is a critical SQL injection vulnerability in projectworlds Car Rental System 1.0 that allows unauthenticated attackers to directly manipulate database queries through the payment…

Is there a public PoC exploit available for CVE-2026-5645?

Yes, a public proof-of-concept exploit is available for CVE-2026-5645. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5645?

24 hours: Identify all instances of projectworlds Car Rental System 1.0 in production and isolate affected systems from public internet access or disable the /pay.php endpoint if business-critical functionality permits. 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the mpesa parameter; escalate to projectworlds for patch timeline and interim security guidance. 30 days: Develop migration plan to alternative car rental software with active security maintenance; if upgrade unavailable, implement input validation/parameterized queries at application level or conduct full code audit for similar injection vulnerabilities.

PHP CVE-2026-5645

Q: What is the CVSS score of CVE-2026-5645?

CVE-2026-5645 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19221 MEDIUM

SQL Injection (CWE-89)

2026-04-06 VulDB

PHP SQLi Car Rental System Projectworlds

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 10:45 euvd

EUVD-2026-19221

Analysis Generated

Apr 06, 2026 - 10:45 vuln.today

CVE Published

Apr 06, 2026 - 10:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to manipulate database queries via the mpesa parameter in /pay.php. The vulnerability carries a CVSS score of 7.3 with network-based exploitation requiring low complexity and no user interaction. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation, though no CISA KEV listing confirms active widespread exploitation at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) affecting the parameter handler component of projectworlds Car Rental System 1.0, specifically within the /pay.php endpoint. The flaw exists in server-side input validation where the 'mpesa' parameter is insufficiently sanitized before being incorporated into SQL database queries. SQL injection occurs when attacker-controlled input is directly concatenated into SQL statements without proper escaping or parameterized queries, allowing attackers to break out of the intended query structure and execute arbitrary SQL commands. The affected product (CPE: cpe:2.3:a:projectworlds:car_rental_system:*:*:*:*:*:*:*:*) is a PHP-based web application commonly used for vehicle rental management. The /pay.php file appears to handle payment processing functionality, making it a critical component where database interactions with financial or transaction data likely occur. The vulnerability's location in payment processing functionality suggests potential exposure of sensitive customer, transaction, or payment data.

RemediationAI

No vendor-released patch identified at time of analysis based on available data sources. Organizations running projectworlds Car Rental System 1.0 should immediately implement compensating controls while awaiting an official patch. Primary recommended action is to disable or restrict access to the /pay.php endpoint until a patched version becomes available, implementing IP allowlisting if the functionality must remain operational. Implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting the mpesa parameter, including common injection techniques like single-quote escapes, UNION statements, and comment sequences. Application-level remediation requires modifying /pay.php to use parameterized queries or prepared statements for all database interactions involving the mpesa parameter, ensuring user input is never directly concatenated into SQL strings. Conduct comprehensive code review of all payment processing modules and parameter handlers for similar SQL injection vulnerabilities. Refer to VulDB advisory at https://vuldb.com/vuln/355433 and exploit analysis at https://github.com/2840364044/SQL-Vulnerability-database/issues/1 for technical details. Consider migrating to alternative rental management solutions if vendor does not provide timely security updates.