An unsanitized Message parameter in the /message_admin.php script of projectworlds Car Rental System 1.0 allows an attacker to inject arbitrary SQL statements. This flaw is the result of improper input validation, aligning with CWE‑74 (SQL injection via improperly encoded input) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command). The injection can enable an attacker to read, modify, or delete database contents, compromising customer and vehicle data confidentiality, integrity, and potentially availability.

The vulnerability affects projectworlds Car Rental System version 1.0, specifically the Parameter Handler component found in the message_admin.php file. The code resides in the publicly released 1.0 distribution and is expected to be deployed on web servers that host the application, though the underlying operating system or database platform is not specified.

With a CVSS score of 6.9 the vulnerability is rated medium. No EPSS score is available, but the description indicates the attack can be launched remotely through a crafted HTTP request targeting the Message parameter. The exploit has been publicly disclosed, suggesting that attackers could easily obtain the exploit code. The vulnerability is not listed in the CISA KEV catalog, yet its remote nature and the lack of mitigation measures on the target environment mean a high likelihood of exploitation if left unpatched.