Car Rental System EUVD-2025-19528

The vulnerable component is the /admin/approve.php script in Car Rental System 1.0. The CVSS 4.0 vector assigns PR:N (no privileges required), indicating the public assessment found no enforced authentication barrier; however, the /admin/ path is strongly suggestive of an admin panel, and defenders should verify whether session authentication is actually required before treating this as unauthenticated. Exploitation requires: (1) network reachability to the web server hosting the application, and (2) the unpatched 1.0 release of this specific application to be running. No special tools beyond a standard HTTP client are needed given the trivial SQL injection technique. Exploitation is limited by: the niche and non-production nature of most code-projects.org deployments, possible admin session requirements not reflected in the CVSS, and the very low EPSS probability (0.05%).

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as unauthenticated, network-accessible with no complexity barrier, yet the resulting score of 5.5 reflects only moderate impact (VC:L/VI:L/VA:L). This impact weighting appears conservative for a SQL injection primitive - full database exfiltration and modification are typically achievable, warranting higher C and I ratings. A material inconsistency exists: the vulnerable script resides at /admin/approve.php, which strongly implies an admin-gated context, yet PR:N is assigned; defenders must verify empirically whether the admin panel enforces authentication before concluding this is exploitable without credentials. EPSS is 0.05% (14th percentile), indicating very low community-assessed exploitation probability. No CISA KEV listing exists. A public POC is confirmed on GitHub. Taken together, the theoretical risk of the SQL injection primitive is high, but realistic exploitation probability is low given the niche deployment footprint and likely admin-auth gate.

An attacker with network access to the application sends a crafted HTTP request to /admin/approve.php with a SQL payload injected into the ID parameter (e.g., ID=1' OR '1'='1). The backend PHP script passes this value directly to the database query, allowing the attacker to enumerate tables, extract credentials or booking records, or modify data. A public POC demonstrating this technique is available at https://github.com/MaxedFF/cve/issues/1.