Car Rental Project EUVD-2026-18482

Real-world risk is HIGH despite the 7.3 CVSS score being below critical threshold. The CVSS vector reveals critical risk factors: network attack vector (AV:N) means any internet-connected instance is vulnerable, low attack complexity (AC:L) requires no special conditions, no privileges required (PR:N) means unauthenticated exploitation, and no user interaction (UI:N) enables fully automated attacks. The exploit maturity level (E:P) indicates proof-of-concept code exists, confirmed by the GitHub POC reference. While EPSS probability data is unavailable for this recent CVE, the combination of public exploit availability, unauthenticated remote access, and trivial attack complexity suggests high likelihood of opportunistic scanning and exploitation. The confidentiality, integrity, and availability impacts are all rated Low (C:L/I:L/A:L), but SQL injection can often be escalated beyond initial CVSS scoring-attackers may achieve full database compromise, privilege escalation to underlying OS via SQL server features (e.g., xp_cmdshell in MSSQL), or use extracted credentials for lateral movement. Not present in CISA KEV, indicating no confirmed widespread exploitation campaigns yet, but the public POC significantly increases risk for unpatched systems. Organizations running this software face immediate risk of authentication bypass, data theft (customer records, payment information), website defacement, and potential ransomware deployment if attackers gain deeper system access.

An external attacker identifies a small car rental business running projectworlds Car Rental Project 1.0 through HTTP banner analysis or Shodan search. Using the publicly available GitHub POC, the attacker crafts a malicious HTTP POST request to /login.php with payload uname=' OR '1'='1'-- &password=anything, bypassing authentication to gain administrative dashboard access. Once inside, the attacker escalates the attack using UNION-based injection (uname=' UNION SELECT table_name,column_name,3 FROM information_schema.columns--) to enumerate database schema, then extracts customer personally identifiable information including names, addresses, credit card details, and driver's license numbers. The attacker either sells this data on dark web markets or uses it for identity theft. In a more severe scenario, the attacker uses SQL injection to write a PHP webshell to the server filesystem via INTO OUTFILE commands, establishing persistent remote access for ransomware deployment. The low attack complexity and lack of required authentication make this exploitable by even novice attackers using automated scanning tools.