CVE-2026-5645: SQL Injection in projectworlds Car Rental System

Successful exploitation of CVE-2026-5645 allows an attacker to inject arbitrary SQL commands into the projectworlds Car Rental System. This could lead to a complete compromise of the database, enabling attackers to extract sensitive information such as user credentials, rental agreements, and financial data. Furthermore, an attacker could modify data, potentially disrupting operations or creating fraudulent records. Given the publicly available exploit, the risk of exploitation is high. The blast radius extends to all data stored within the Car Rental System's database, and a successful attack could severely damage the organization's reputation and financial stability.

1. Reserved2026-04-05
2. Published2026-04-06
3. EPSS updated2026-04-13

The primary mitigation for CVE-2026-5645 is to upgrade to a patched version of projectworlds Car Rental System as soon as it becomes available. Until a patch is released, implement temporary workarounds to reduce the risk of exploitation. These include deploying a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the /pay.php endpoint. Additionally, implement strict input validation on the 'mpesa' parameter, ensuring it conforms to expected data types and lengths. Consider implementing parameterized queries or prepared statements to prevent SQL injection vulnerabilities. After implementing these mitigations, verify their effectiveness by attempting to reproduce the vulnerability using a safe testing environment.