Anisha Car Rental System: SQL Injection in book_car.php (CVE-2025-6907)

CVE-2025-6907 is a critical SQL injection vulnerability affecting Anisha Car Rental System version 1.0. The flaw resides in the book_car.php script, specifically within the fname parameter. A public C-based exploit has been released that automates boolean-based and time-based injection attacks against this parameter. The exploit tool also includes features for environment discovery, including scanning for web directories and dumping process memory maps on the host.

Attack Chain

1. Attacker identifies a target running Anisha Car Rental System 1.0.
2. Attacker sends an HTTP request to book_car.php with a crafted SQL payload in the fname parameter.
3. The application fails to sanitize the input, passing the malicious payload directly to the backend database.
4. The database executes the injected SQL command.
5. The attacker observes the result through application response content or time-based response delays.
6. Attacker leverages this access to dump database contents or potentially interact with the underlying host if administrative privileges are improperly configured.

Impact

Successful exploitation allows unauthenticated remote attackers to perform unauthorized database operations, potentially leading to full system compromise. The vulnerability is rated CVSS 9.8.

Recommendation

• Identify all instances of Anisha Car Rental System 1.0 within the environment.
• Patch or decommission affected systems immediately; there is currently no official vendor update mentioned in the exploit source.
• Block or monitor HTTP requests to book_car.php containing SQL metacharacters (e.g., single quotes, semicolons, comments, or sleep commands).
• Review web server access logs for anomalous activity involving the book_car.php endpoint.