CVE-2026-5368 is a SQL injection flaw (CWE-89) in projectworlds Car Rental Project 1.0, in /login.php, through the uname parameter. NVD scores it 7.3 high and says a public exploit exists. No fixed version is named, so remove public access and patch the query yourself.
What's affected
projectworlds Car Rental Project version 1.0, per the CVE record. The weak spot is the /login.php file, handled by the component the record calls Parameter Handler, and the uname argument is the input that reaches the database.
The record lists no patched release. Treat every copy of version 1.0 as affected until you have changed the code.
How to check if you're exposed
This is a downloadable PHP sample project, so there is no package manager entry to query. Look in your web root instead.
grep -rn "uname" --include=*.php /var/www/
Open /login.php and read how uname is used. If the value is placed into a SQL string by concatenation, the code is exposed. The login page is the first thing an outside visitor reaches, so this one needs no account to test.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every deployment of Car Rental Project 1.0, including test and demo copies that were put online and forgotten.
- Take public instances offline or restrict them to a VPN or an allowlist of addresses until the code is fixed.
- Rewrite the query that uses
unameas a prepared statement with bound parameters, using PDO or mysqli, and cast numeric ids to integers before use. - Search web server and database logs for unusual values in this parameter and for SQL errors returned to clients.
- Use a dedicated low privilege database account for the app so that a query flaw cannot touch other schemas.
Why it matters
SQL injection (CWE-89, a child of the injection family CWE-74) happens when user input becomes part of a query instead of data passed to it. The write-up for this CVE states the cause plainly: the uname value is used directly in a SQL query without cleaning or validation.
The affected file is the login page. The record only says the flaw allows SQL injection, so do not assume more than that, but a login query is a place where input handling deserves the most care. The record does not flag this CVE as a CISA Known Exploited Vulnerability, but it does say the exploit has been published.
Quick check
Is there a patch for Car Rental Project 1.0?
None is named in the record or in the issue that reports it. Check the vendor site and the advisory for updates, and fix the query in your own copy if you must keep running it.
Why does the login page matter more?
Anyone on the internet can reach it without an account, so the exposed surface is as wide as it gets for a web app. Put it behind access controls while you fix the query.
Sources
Last reviewed: 19 October 2026.
