CVE-2026-5368: Projectworlds Car Rental Project SQL injection in login.php via uname parameter
CVE-2026-5368 is an SQL injection flaw in the /login.php file of projectworlds Car Rental Project 1.0, triggered through the uname argument. NVD lists a CVSS 3.1 base score of 9.8 (critical), and the record states that a public exploit has been disclosed. CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
CVE-2026-5368 affects the /login.php file of projectworlds Car Rental Project 1.0. According to the record, manipulation of the uname argument in the parameter handler causes SQL injection (CWE-89). The record was published on 2026-04-02 and assigned by VulDB.
Impact
NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable issue requiring no privileges or user interaction and with high impact on confidentiality, integrity and availability. Other scores in the record range from 5.5 to 9.8 depending on the CVSS version and provider. The SSVC assessment in the record rates technical impact as partial and marks the issue as automatable.
Affected products and versions
- Projectworlds Car Rental Project, version 1.0.
No other affected versions are listed in the sources consulted.
Exploitation status
CISA KEV does not list CVE-2026-5368. No confirmed exploitation in the wild appears in the sources consulted. The record states that an exploit has been publicly disclosed, and a third-party issue tracker entry is tagged as an exploit reference. The SSVC exploitation value is recorded as proof of concept. The EPSS probability is 0.00572 with a percentile of 0.4659.
Remediation and mitigation
The record does not identify a vendor patch or a fixed version. The only fix entry is a mitigation reference to a third-party GitHub issue. Until an official fix is confirmed, operators should restrict access to the affected login page, limit exposure to untrusted networks, review whether the application is still in use, and consider replacing or hardening it. Developers should use parameterized queries and strict input validation for authentication fields.
Detection guidance
At a high level, review web server and application logs for login requests with unusual or malformed values in the uname field, unexpected database error messages on the login endpoint, and authentication activity that does not match normal user behavior. Correlate these events with source addresses and review any successful logins that followed them.
Limitations of the available information
The sources consulted do not include a vendor advisory, a confirmed fixed version, or a detailed technical description beyond the summary. The affected version range is limited to 1.0 in the record. The scores differ between CVSS versions and providers, and the sources do not explain the difference in detail.
Frequently asked questions
What is CVE-2026-5368?
It is an SQL injection vulnerability in the /login.php file of projectworlds Car Rental Project 1.0, triggered through the uname argument.
Is CVE-2026-5368 known to be actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been disclosed.
Is there an official fix?
The record does not identify a vendor patch or fixed version. It only lists a mitigation reference to a third-party GitHub issue.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.