This vulnerability affects projectworlds Car Rental Project 1.0, specifically an unknown functionality in /book_car.php's Parameter Handler component. Manipulating the fname parameter leads to SQL injection, allowing an attacker to inject malicious SQL commands remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no required privileges or user interaction. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This could lead to unauthorized data access, modification, or deletion depending on the database permissions. However, the CVSS vector indicates limited confidentiality, integrity, and availability impact, suggesting partial or limited data exposure or modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the fname parameter. Monitoring for unusual database queries may also help detect exploitation attempts.