The projectworlds Car Rental System 1.0 contains a SQL injection vulnerability in the /message_admin.php file's Parameter Handler component. Specifically, the Message parameter is susceptible to injection attacks, allowing an unauthenticated remote attacker to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating a moderate risk with network attack vector and no privileges or user interaction required. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely without authentication, increasing the risk of compromise. However, the impact is rated medium due to limited scope and complexity factors as per the CVSS vector. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or parameterized queries as a temporary mitigation if possible. Monitor for updates from projectworlds regarding patches or official remediation instructions.