Executive brief
A vulnerability exists in the login page of the projectworlds Car Rental Project, a web application used for managing vehicle rentals. An attacker can exploit this flaw to bypass authentication, access the underlying database, and potentially steal sensitive customer or business information. This could lead to a total compromise of the application's data and unauthorized control over the rental system.
Technical details
A SQL injection vulnerability exists in projectworlds Car Rental Project 1.0 within the 'uname' parameter of the /login.php file. The application fails to properly sanitize or validate user-supplied input before incorporating it into a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted POST requests containing SQL commands (such as boolean-based or time-based blind injection payloads). Successful exploitation allows for unauthorized data retrieval, modification, or deletion from the backend MySQL database. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- projectworlds Car Rental Project 1.0
Timeline
- 2026-03-17: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-02: advisory: CVE-2026-5368 published.