The vulnerability is a classic SQL injection flaw caused by improper neutralization of user input that is passed to sorting functions. An unauthenticated attacker can supply crafted input to influence the SQL statements executed by the application, potentially allowing data exfiltration or modification. The weakness is listed as CWE-89, which captures the root cause: lack of input validation.

The flaw affects the PHP Jabbers Car Rental Script application. All installations prior to the vendor fix in version 4.1 are vulnerable, as the description states that the issue was addressed in 4.1. No other versions are expressly mentioned.

The CVSS score of 9.3 marks this as a critical flaw. The EPSS score of less than 1 % suggests limited exploitation activity so far, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can trigger the flaw simply by sending an unauthenticated HTTP request containing a specially crafted sorting parameter. Because the attack vector is the publicly exposed Web interface, the attack does not require any privileged access and can be launched remotely.