Car Rental System CVE-2026-5645

Real-world risk is HIGH despite the absence of CISA KEV confirmation. The CVSS 7.3 score reflects significant risk with network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), enabling trivial exploitation. The proof-of-concept exploit code is publicly available on GitHub, dramatically reducing attacker effort and expertise required for exploitation. While CVSS impact ratings show only Low confidentiality, integrity, and availability impact (C:L/I:L/A:L), SQL injection vulnerabilities frequently enable complete database compromise through techniques like UNION-based extraction, blind boolean enumeration, or stacked queries depending on database backend and application permissions. The combination of unauthenticated remote access, public exploit availability, and SQL injection class vulnerability (historically among OWASP Top 10) creates immediate actionable risk. Organizations running this software face realistic threat of data exfiltration, authentication bypass, data manipulation, or pivot points for deeper network compromise. The absence of remediation level information (RL:X in CVSS temporal vector) suggests no vendor-released patch was confirmed at initial disclosure, further elevating operational risk for existing deployments.

An unauthenticated remote attacker identifies the projectworlds Car Rental System installation and navigates to the payment processing endpoint at /pay.php. The attacker crafts a malicious HTTP request manipulating the mpesa parameter with SQL injection payload such as: mpesa=' UNION SELECT username,password,email FROM users-- -. Because the application fails to sanitize this input, the injected SQL executes against the backend database, returning administrative credentials or customer payment information in the application response. The attacker leverages extracted credentials for administrative account takeover, exfiltrates the complete customer database including personally identifiable information and payment records, or modifies reservation and pricing data for financial fraud. Given the publicly available exploit code on GitHub, even low-skill attackers can successfully execute this attack with minimal reconnaissance effort.