This vulnerability in projectworlds Car Rental System 1.0 allows an attacker to perform SQL injection via the Message parameter in the /message_admin.php file. The flaw exists in the Parameter Handler component, enabling remote attackers to manipulate SQL queries by injecting malicious input. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited scope and partial impact on confidentiality, integrity, and availability. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates. Until a patch is available, restricting access to the vulnerable endpoint and employing web application firewall rules to detect and block SQL injection attempts may help reduce risk.