This vulnerability affects projectworlds Car Rental System 1.0, specifically an unknown functionality in the /pay.php file's Parameter Handler component. By manipulating the 'mpesa' parameter, an attacker can perform SQL injection attacks remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required. No official fix or patch has been disclosed, and the vendor has not provided remediation details.

Successful exploitation allows remote attackers to execute SQL injection attacks via the 'mpesa' parameter in /pay.php. This could lead to unauthorized access to or manipulation of the backend database. The vulnerability is exploitable without authentication or user interaction, increasing risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible damage potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'mpesa' parameter. Monitor for any updates from the vendor regarding patches or official mitigations.