Car Rental System EUVD-2026-19203

Real-world risk is HIGH. The CVSS vector confirms this is remotely exploitable (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and no user interaction (UI:N), making it trivially exploitable by unsophisticated attackers. Publicly available exploit code exists per the GitHub reference, eliminating the need for attackers to develop custom exploits. The CVSS temporal metrics show E:P (Proof-of-concept exploit exists) and RC:R (Reasonable attack code is available), confirming weaponization. While EPSS score is not provided, the combination of unauthenticated network access, low complexity, and public exploit code historically correlates with EPSS scores above 0.5. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation at time of analysis, but the public exploit significantly increases exploitation probability. SSVC decision factors suggest ELEVATED priority: exploitation status is POC-available, attack is automatable via web requests, and technical impact enables data exfiltration and integrity compromise of administrative functions. The scope is limited to Car Rental System 1.0 deployments, which may have limited internet exposure, but any internet-facing instance is immediately vulnerable.

An unauthenticated attacker identifies a Car Rental System 1.0 installation through internet scanning or reconnaissance. Using the publicly available exploit code from GitHub (https://github.com/eqiya17/collection-of-vulnerabilities/issues/13), the attacker crafts a malicious HTTP POST request to /message_admin.php with a SQL injection payload in the Message parameter, such as: Message=' UNION SELECT username,password,email FROM admin_users--. The vulnerable Parameter Handler concatenates this input directly into a SQL query without sanitization, causing the database to execute the attacker's injected commands. The attacker successfully extracts administrative credentials, customer personal information including names and payment details, and rental transaction records from the database. With obtained admin credentials, the attacker could further compromise the system by modifying rental rates, creating fraudulent reservations, or deploying additional malware. The attack requires no authentication and can be fully automated, enabling mass exploitation of multiple vulnerable installations.