CVE-2020-11544

Project Worlds Official Car Rental System 1 contains an arbitrary file upload vulnerability in the file-manager upload section (add_cars.php). There are no restrictions on executable file uploads, allowing an admin to run commands on the server with their account. The connected reports confirm th...

CVE-2020-11545

CVE-2020-11545 affects Project Worlds Official Car Rental System 1, where multiple SQL injection flaws exist in PHP/MySQL components (e.g., account.php, login.php, book_car.php). The described impact is database data exposure (dump of MySQL data) and bypass of login authentication. Root cause ind...