Executive brief
Montodel House-Rental-Management, a software used for managing rental properties, contains a security flaw that allows unauthorized database access. By sending a specially crafted request, an attacker can view, modify, or delete sensitive information stored in the system's database. This could lead to the exposure of tenant records, financial data, or a complete loss of service for the property management platform.
Technical details
A SQL injection vulnerability exists in Montodel House-Rental-Management V1.0 (up to commit 90010017b81265eb1ef3810268909f7719a33863) within the /index.php?page=houses component. The root cause is the improper neutralization of special elements in the 'id' parameter, which is used directly in SQL queries without sufficient validation or prepared statements. An attacker with low-level privileges can exploit this remotely via boolean-based blind or time-based blind injection techniques. Successful exploitation allows for unauthorized database access, data tampering, and potential disclosure of sensitive information. As of the advisory date, the vendor has not responded to the disclosure, and no official patch is available.
Affected products
- Montodel House-Rental-Management V1.0 up to commit 90010017b81265eb1ef3810268909f7719a33863
Timeline
- 2026-05-21: disclosed: Initial disclosure on GitHub issues
- 2026-06-21: advisory: NVD publication date