This vulnerability in projectworlds Car Rental System 1.0 involves SQL injection through the 'mpesa' parameter in the /pay.php file's Parameter Handler component. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No official fix or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact on confidentiality, integrity, and availability is rated as low to low, reflecting limited but non-negligible risk. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to block or sanitize the 'mpesa' parameter in /pay.php. Monitor vendor channels for updates and apply patches promptly once released.