CVE-2025-6905 is a high (CVSS 7.3) SQL injection flaw in code-projects Car Rental System 1.0. Input handled by the fname parameter of /signup.php reaches a database query unsafely. The record names no fixed version, so restrict access, correct the query code, or retire the app.
What's affected
code-projects Car Rental System version 1.0, per the record. The affected file is /signup.php, in the sign up page code. The reported input is the fname parameter in that file.
/signup.php is part of the sign up page, which visitors reach before signing in. That makes the flaw reachable by anyone who can load the site.
The NVD description calls this issue critical. That label comes from the reporting database. The CVSS 3.1 base score in the record is 7.3, which falls in the High (7.0 to 8.9) band, and this post uses that.
I could not confirm a fixed version. The record's references are the vendor site home page, a researcher's report on GitHub and VulDB entries, and none of them as listed in the record names a patched release. Check the code-projects site or your copy's source before relying on a newer build. The record also says the exploit details have been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.
How to check if you're exposed
This is a downloadable sample style application, not a package from npm or PyPI, so there is no version command. Work from the files on disk and the web server logs.
Confirm the app is present and which file is vulnerable. Adjust the web root to your server:
find /var/www -path "*signup.php" 2>/dev/null
Then look at how the file builds its query. A query assembled by joining request data into a string is the problem pattern:
grep -nE "mysqli_query|mysql_query|->query\(" /var/www/html/signup.php
Check your access logs for requests to the file, looking for unusual or very long values in the fname parameter:
grep "signup.php" /var/log/apache2/access.log | tail -50
Do not test this on a system you do not own. If the app is internet facing and you cannot say who owns it, treat it as exposed.
What to do now
- Find every copy of Car Rental System in your environment, including old test and demo servers. Sample projects are often copied around and forgotten.
- If the app is not needed, take it offline. It is the only complete fix when no vendor patch exists.
- If it must stay, remove it from the public internet. Put it behind a VPN or an allow list of known addresses.
- Change the query code in
/signup.phpto use prepared statements with bound parameters, and review neighboring files, since the same pattern is likely elsewhere in the project. Several sibling CVEs in the same product family were filed on the same day. - Make sure the database account the app uses can only reach its own database and has no file or admin privileges.
- Rotate any passwords stored in or used by the app if you see signs of unusual requests, and keep a backup before changing code.
Why it matters
The weakness is classic SQL injection. The application builds a database statement by joining request data into a string, so the database cannot tell where the developer's query ends and the visitor's input begins. The record lists CWE-89 (SQL injection) and CWE-74 (improper neutralization of special elements in output used by a downstream component).
The impact depends on what the database holds. CVSS rates confidentiality, integrity and availability each as low for this record, which is the usual score for a single injectable query in a small app. In practice, a flaw like this can expose or alter the records the app stores, and in an app with a user table it can touch login data. The advisory text does not claim more than that, and neither do we.
The fix for this class of bug is well known: prepared statements with bound parameters, plus least privilege for the database account the app uses. That fix lives in the source code, which is why a vendor release is the easy answer when one exists. Here the record names none.
Try it with your own code
Car Rental System is a standalone app, so a package scan will not find it. If the project sits in a repository, the free in-browser dependency scan at gold.safeguard.sh/scan can list the libraries it pulls in, and reachability analysis helps separate flaws your code really calls from those it does not. Source code like /signup.php still needs a code review.
Quick check
Is there a patch for CVE-2025-6905?
The record does not name a fixed version, and I could not confirm one from the references. Check the vendor site, and plan on fixing the query code yourself or removing the app.
Does a web application firewall solve this?
It can reduce noise, but it is a stopgap. A rule can block known patterns and miss new ones. The lasting fix is to use bound parameters in the code.
Sources
- Safeguard Gold entry for CVE-2025-6905
- https://code-projects.org/
- https://github.com/zzb1388/cve/issues/15
- https://vuldb.com/?ctiid.314399
- https://vuldb.com/?id.314399
- https://vuldb.com/?submit.606156
Last reviewed: 18 October 2026.
