An unauthenticated SQL injection vulnerability in Projectworlds Car Rental System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user input provided via the fname parameter in the /book_car.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL queries, enabling unauthorized database interaction.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may lead to the exfiltration of sensitive user information, data tampering, or complete system compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in severe operational disruption or regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /book_car.php endpoint via network controls or disable the affected functionality entirely until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /book_car.php, specifically searching for SQL syntax characters or time-based payloads like SLEEP statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the fname parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the research write-up on GitHub.

Due to the lack of an official patch and the public availability of exploit details, this vulnerability poses a clear and present danger to affected environments. Organizations currently utilizing Projectworlds Car Rental System 1.0 must prioritize the implementation of compensating controls or isolate the application from external networks to prevent unauthorized database access.