An unauthenticated SQL injection vulnerability in Projectworlds Car Rental System 1.0 poses a critical risk of unauthorized database access and potential full system compromise.

The application fails to properly sanitize the mpesa parameter within the pay.php script before incorporating it into database queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized data exfiltration or modification.

Successful exploitation of this vulnerability allows an attacker to bypass authentication, access sensitive customer information, and potentially modify or delete database records. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality, which could lead to severe reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict access to the pay.php endpoint via network controls or disable the component entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests to pay.php containing SQL syntax characters, such as single quotes, dashes, or SQL keywords like UNION and SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the mpesa parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub repository referenced in the vulnerability record.

Given the availability of public exploit material, this vulnerability should be treated with high urgency. Organizations utilizing Projectworlds Car Rental System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, until a formal security update is released by the vendor to address the underlying code flaw.