An unauthenticated SQL injection vulnerability in Projectworlds Car Rental System 1.0 allows remote attackers to compromise the underlying database and potentially gain full system control.

This flaw is a SQL injection vulnerability (CWE-89) located in the /message_admin.php file. Attackers can exploit this by injecting malicious SQL commands into the message parameter without requiring any authentication.

The exploitation of this vulnerability poses a severe risk to business operations, as it permits unauthorized access to sensitive database contents, data tampering, and potential service disruption. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the entire application environment, potentially leading to total system compromise.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /message_admin.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review database access logs for unusual query patterns, such as the use of sleep functions or unexpected character sequences in the message parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub security issue.

Given the availability of public proof-of-concept code and the lack of a vendor-provided patch, users of Projectworlds Car Rental System 1.0 must treat this as a critical exposure. Immediate steps should be taken to isolate the vulnerable application from external networks to prevent unauthorized database access while awaiting a permanent security update.