CVE-2026-5368
SQL Injection in Car Rental Project 1.0 /login.php Enables Remote Attack
Publication date: 2026-04-02
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| projectworlds | car_rental_project | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Car Rental Project 1.0 allows unauthorized database access, data leakage, modification, or deletion. Such unauthorized access and potential data breaches can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive data.
Failure to prevent SQL injection attacks may result in exposure of personal data, violating data protection requirements and potentially causing legal and financial consequences under these regulations.
Remediation steps such as using prepared statements, input validation, minimizing database privileges, and regular security audits are critical to maintaining compliance by protecting data integrity and confidentiality.
Can you explain this vulnerability to me?
CVE-2026-5368 is a critical SQL injection vulnerability found in the Car Rental Project version 1.0, specifically in the /login.php file. The issue arises because the uname parameter is improperly handled and directly embedded into SQL queries without proper input validation or sanitization.
This flaw allows attackers to inject malicious SQL code remotely without any authentication, enabling them to access, modify, or delete database information. Attackers can perform boolean-based blind SQL injection and time-based blind SQL injection attacks to exploit this vulnerability.
Proof-of-concept payloads demonstrate how attackers can manipulate the uname parameter to execute these attacks, potentially leading to unauthorized database access and full system compromise.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data, data leakage, modification or deletion of database records, and potential full system compromise or service disruption.
Since the vulnerability can be exploited remotely without authentication, attackers can manipulate the database to gain control or disrupt services, which can affect the availability and integrity of your system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the `uname` POST parameter in the `/login.php` file for SQL injection flaws. Attackers can exploit boolean-based blind SQL injection and time-based blind SQL injection techniques.
- Use boolean-based blind injection payloads such as: uname=admin' AND 8756=8756 AND 'HXZJ'='HXZJ
- Use time-based blind injection payloads (for MySQL >= 5.0.12) such as: uname=admin' AND (SELECT 3870 FROM (SELECT(SLEEP(5)))odlP) AND 'TXhM'='TXhM
- Use automated tools like sqlmap to test the vulnerability by executing time-delayed queries against the `uname` parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Use prepared statements with parameter binding to separate SQL code from user input, preventing SQL injection.
- Implement strict input validation and filtering to ensure inputs conform to expected formats.
- Minimize database user permissions by avoiding high-privilege accounts (such as root or admin) for routine database operations.
- Conduct regular security audits to detect and address vulnerabilities promptly.