The vulnerability is in the login.php file of the projectworlds Car Rental Project. An unspecified function in the Parameter Handler processes the uname parameter without proper sanitization, allowing an attacker to inject arbitrary SQL statements. This results in a classic SQL injection flaw (CWE‑89) combined with improper input validation (CWE‑74). If exploited, the attacker could read, modify, or delete data in the underlying database, thereby compromising confidentiality, integrity, and potentially availability of the application data.

This flaw affects projectworlds’ Car Rental Project version 1.0. Users running this version should verify whether the login.php component has been patched or replaced by a newer build, as the affected element is tied to the Parameter Handler module.

The CVSS score of 6.9 places this vulnerability in the Medium severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The description indicates that remote exploitation via the web interface is possible, so attackers can likely trigger it by sending crafted HTTP requests containing malicious uname values to the login page. Given the public disclosure and lack of an official patch, the risk of active exploitation remains significant. Its Medium severity, combined with the remote nature of the attack, suggests that attackers could target exposed instances of this application.