Executive brief
A security vulnerability exists in the Online House Rental System, a web application used for managing rental properties and tenants. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially allowing them to steal sensitive tenant information or modify system records. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in itsourcecode Online House Rental System 1.0 within the '/manage_tenant.php' file. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to perform boolean-based, error-based, or time-based blind SQL injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential tampering with tenant records. No official patch has been identified, but remediation typically involves implementing prepared statements with parameterized queries.
Affected products
- itsourcecode Online House Rental System 1.0
Timeline
- 2026-05-09: disclosed: Public exploit and vulnerability details shared on GitHub
- 2026-06-01: advisory: NVD/VulDB advisory published