A flaw in the book_car.php script of the projectworlds Car Rental Project allows an attacker to manipulate the fname parameter without proper sanitization, resulting in a classic SQL injection vulnerability. Through this vulnerability an adversary can execute arbitrary SQL commands against the underlying database, potentially reading, modifying, or deleting sensitive rental data. This threat undermines the confidentiality, integrity, and could compromise availability if excessive or disruptive queries are performed.

The vulnerability affects version 1.0 of the projectworlds Car Rental Project, specifically the Parameter Handler component within the book_car.php page. No other versions or vendors are reported to be impacted by this particular flaw.

The CVSS score of 6.9 indicates a moderate to high risk level. EPSS data is not supplied, and the issue is not listed in the CISA KEV catalog. The vendor description confirms that the attack can be initiated remotely and that a public exploit exists, suggesting that attackers can deliver malicious payloads via standard HTTP requests to the vulnerable page.