EUVD-2026-19200
GHSA-xhjx-m35j-wjqw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N) confirms network-accessible, unauthenticated attack with low complexity. CVSS impact ratings (VC:L/VI:L/VA:L) reflect limited confidentiality and integrity damage per the vendor scoring, though SQL injection typically poses broader database compromise risk depending on database permissions and data sensitivity. The presence of publicly available exploit code (POC=YES) combined with remote network accessibility significantly elevates practical risk despite the moderate CVSS score. The absence of CEI (Changes Exploitability Indicator) values and lack of CISA KEV confirmation suggest this is not yet confirmed as actively exploited in the wild, but the public POC availability means exploitation is probable. Organizations running Car Rental Project 1.0 face immediate risk of database enumeration, unauthorized data access, and potential data modification if database user permissions are broadly assigned. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers the Car Rental Project instance and crafts a malicious request to /book_car.php with a SQL injection payload in the fname parameter (e.g., fname=test' OR '1'='1). Due to the absence of input validation, the injected SQL is executed against the backend database. The attacker can extract sensitive customer data, booking details, or administrative credentials. With publicly available exploit code documented at https://github.com/eqiya17/collection-of-vulnerabilities/issues/12, an attacker with minimal technical skill can rapidly reproduce and weaponize this vulnerability at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
SQL injection in projectworlds Car Rental Project 1.0 allows remote attackers to execute arbitrary SQL queries via the fname parameter in /book_car.php, enabling unauthenticated database manipulation with potential confidentiality and integrity impact. The vulnerability has publicly available exploit code and a moderate CVSS score of 6.9, indicating practical exploitability despite low attack complexity.
RemediationAI
Immediate remediation requires upgrading to a patched version of projectworlds Car Rental Project if available from the vendor; however, no vendor-released patch version is independently confirmed in current advisory data. As an interim mitigation, apply input validation and parameterized queries (prepared statements) to the /book_car.php file, specifically sanitizing the fname parameter before use in any SQL statement. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the fname parameter. Consult VulDB submission https://vuldb.com/submit/785863 and monitor the vendor repository for official patch releases. Apply principle of least privilege to database user accounts to limit the scope of data accessible via SQL injection exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Parameter Handler component of the Car Rental Project, a PHP-based web application. The root cause is improper input validation and parameterization in the SQL query construction for the /book_car.php endpoint. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-supplied input from the fname parameter is incorporated directly into SQL statements without adequate escaping, type casting, or prepared statement use. The affected product spans the Car Rental Project codebase (CPE: cpe:2.3:a:projectworlds:car_rental_project:*:*:*:*:*:*:*:*), suggesting all versions prior to any vendor-issued patch are vulnerable.
Know when Car Rental Project gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in projectworlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /book_car.php of the component Parameter Handler. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in projectworlds Car Rental Project SQL Injection
View all 3More in Car Rental Project
View allArbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows a
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Rated medium severity (CVSS 6
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Rated medium severity (C
SQL injection in projectworlds Car Rental Project 1.0 login.php allows unauthenticated remote attackers to bypass authen
A flaw has been found in PHPGurukul Car Rental Project 3.0. Rated medium severity (CVSS 5.3), this vulnerability is remo
Exploit-DB