A weakness in the /pay.php file of projectworlds Car Rental System 1.0 allows an attacker to manipulate the mpesa parameter, enabling arbitrary SQL injection. Because the vulnerable code executes the parameter directly in a database query, an attacker can read, alter, or delete records in the application’s database. This breach compromises data confidentiality and integrity and can affect all customer and transaction information processed by the system.

The affected system is the projectworlds Car Rental System, version 1.0, specifically the Parameter Handler component of the /pay.php script. No other products or versions are indicated as impacted, so the risk is confined to installations of this version.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. However, the vulnerability is exploitable via a remote HTTP request and an exploit code is publicly available, raising the practical risk considerably. An attacker could achieve full database compromise by crafting a malicious mpesa value and sending it to the pay.php endpoint from an external source.