Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters ...
Date: 2020-04
Affected: projectworlds/official_car_rental_system
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2020-11545
CWE: CWE-89
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt.


Mitigations:

Architectural layers (MAESTRO):