PT-2026-30579 · Projectworlds · Car Rental Project

Wangyiqi · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5634

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions projectworlds Car Rental Project version 1.0

Description A vulnerability exists in projectworlds Car Rental Project 1.0 related to SQL injection. The issue is located in the /book car.php file within the Parameter Handler component. Manipulation of the fname argument can lead to SQL injection, and the attack can be initiated remotely. The exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /book car.php file or sanitizing the fname parameter to prevent SQL injection.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-5634

Affected Products

Car Rental Project

References · 7

• 🔥 https://github.com/eqiya17/collection-of-vulnerabilities/issues/12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5634 · Security Note
• https://twitter.com/infoflowcloud/status/2041077706557657292 · Twitter Post
• https://vuldb.com/vuln/355422/cti · Note
• https://twitter.com/CVEnew/status/2041076959317254563 · Twitter Post
• https://vuldb.com/vuln/355422 · Note
• https://vuldb.com/submit/785863 · Note