CVE-2026-5645

CVE-2026-5645 is a SQL injection vulnerability affecting projectworlds Car Rental System version 1.0, specifically in the /pay.php file's parameter handler where the "mpesa" argument is improperly validated. An unauthenticated attacker can exploit this weakness remotely to manipulate database queries and potentially access, modify, or delete sensitive information. The vulnerability carries a CVSS score of 7.3 (HIGH), indicating a low-complexity remote attack requiring no user interaction or privileges. The attack vector is network-based with potential impacts to confidentiality, integrity, and availability of system data. The FAUCET Risk Score of 47.0/100 reflects moderate operational risk. Exploitation status indicates the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. However, public exploit code is available, which increases the risk of future attacks. The EPSS score of 0.00037 suggests relatively low near-term exploitation probability, though organizations running this car rental system should prioritize patching before threat actors develop operational attack chains.