CVE-2022-32026

The Car Rental Management System v1.0 is vulnerable to SQL Injection via the /admin/manage_booking.php?id= endpoint. This vulnerability allows an attacker to execute arbitrary SQL queries, which may lead to unauthorized access, data leakage, data manipulation, or the execution of unauthorized adm...

CVE-2022-32025

Car Rental Management System v1.0 is vulnerable to an SQL Injection via the /car-rental-management-system/admin/view_car.php?id= endpoint. An attacker can exploit this flaw to execute arbitrary SQL queries, which may result in unauthorized access, data leakage, or the modification and deletion of...

CVE-2022-32028

Car Rental Management System v1.0 is vulnerable to an SQL Injection vulnerability via the /admin/manage_user.php?id= endpoint. An attacker can exploit this flaw to execute arbitrary SQL queries, which may lead to unauthorized access , data leakage , or the manipulation of data within the back-end...

CVE-2022-32022

Car Rental Management System v1.0 is affected by an SQL Injection vulnerability in the login endpoint (/admin/ajax.php?action=login or /ip/car-rental-management-system/admin/ajax.php?action=login). The issue stems from unsafely constructed SQL queries in the authentication flow, enabling an attac...

CVE-2022-32024

Car Rental Management System v1.0 is vulnerable to SQL Injection via the /booking.php?car_id= endpoint. An attacker can exploit this flaw to execute arbitrary SQL queries, which may lead to viewing, adding, modifying, or deleting information in the back-end database. This could result in data lea...

CVE-2020-29287

CVE-2020-29287 describes an SQL injection in Car Rental Management System v1.0 exploitable via unsanitized input parameters: id in view_car.php and car_id in booking.php. The vulnerability stems from improper input handling in these PHP scripts, allowing attackers to manipulate SQL queries. Sever...

CVE-2022-32021

CVE-2022-32021 affects Car Rental Management System v1.0. The vulnerability is a SQL Injection in the admin module, exploitable via the parameter id in /car-rental-management-system/admin/manage_movement.php. The root cause is improper handling of user-supplied input leading to backend database a...

CVE-2020-29227

CVE-2020-29227 affects Car Rental Management System 1.0. An unauthenticated user can perform a local file inclusion via the /index.php page by supplying a partial filename in the page parameter, resulting in remote code execution on the server. This vulnerability is corroborated by multiple sourc...

CVE-2021-46005

Sourcecodester Car Rental Management System 1.0 is vulnerable to a Cross-Site Scripting (XSS) flaw exposed through the vehicalorcview parameter. The connected nuclei template confirms this is a stored XSS vector, enabling an attacker to inject scripts that may be executed in a victim’s browser. A...

CVE-2022-29318

CVE-2022-29318 affects SourceCodester Car Rental Management System v1.0, specifically the New Entry module. The root cause is lack of validation for uploaded files, enabling arbitrary PHP file uploads and potential code execution. Exploitation details, impacted versions beyond v1.0, and concrete ...

CVE-2022-32019

Summary: CVE-2022-32019 affects Car Rental Management System v1.0. The vulnerability is an Arbitrary Code Execution via the admin/ajax.php?action=save_car endpoint. The connected references corroborate an RCE condition in this path, indicating a severe impact. The exact vulnerable file/parameter ...

CVE-2022-32027

CVE-2022-32027 affects Car Rental Management System v1.0. The vulnerability is a SQL Injection in the admin page parameter: /car-rental-management-system/admin/index.php?page=manage_car&id=. Root cause: unsanitized input in the manage_car ID parameter leading to SQLi. Impact described in sources ...

CVE-2022-32020

CVE-2022-32020 affects Car Rental Management System v1.0. Affected component: ip/car-rental-management-system/admin/ajax.php?action=save_settings. Issue: Arbitrary code execution (RCE) vulnerability reported; CVSS details in sources show high severity (C/I/A: partial/high) with network exposure a...

CVE-2020-27956

CVE-2020-27956 affects SourceCodester Car Rental Management System 1.0. The vulnerability arises from an arbitrary file upload in the Upload Image component, allowing a user to upload PHP files to admin/assets/uploads/ under the web root via admin/index.php?page=manage_car, leading to remote code...

CVE-2020-23832

CVE-2020-23832 affects Projectworlds Car Rental Management System v1.0, specifically the message_admin.php module. The vulnerability is a Persistent Cross-Site Scripting (XSS) that allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session when an ...