Description
A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-06-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a classic SQL injection flaw that occurs when the Username field in the /ajax.php?action=login endpoint is manipulated. By submitting specially crafted input, an attacker can inject arbitrary SQL statements, potentially reading sensitive data, changing records, or compromising the entire database. The weakness is represented by CWE-89 and CWE-74, indicating unvalidated input leading to injection attacks.

Affected Systems

The impact is limited to itsourcecode Online House Rental System version 1.0. No other versions or variants are listed. The vulnerability resides in the ajax.php file of this product, which is available to users of the online house rental system.

Risk and Exploitability

The CVSS score of 6.9 reflects a moderate severity for potential data breaches. An exploit has been made publicly available, and the attack can be performed remotely via the web interface. EPSS data is not available, and the issue is not listed in CISA KEV. The likely attack vector involves sending a crafted HTTP request to the login endpoint from a remote host.

Generated by OpenCVE AI on June 1, 2026 at 14:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched version of itsourcecode Online House Rental System once available.
  • Implement parameter validation and use prepared statements for the Username field to eliminate SQL injection opportunities.
  • Configure database user permissions to the minimum necessary for application functionality to limit damage from successful exploitation.

Generated by OpenCVE AI on June 1, 2026 at 14:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 02 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 13:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Online House Rental System ajax.php login sql injection
First Time appeared Itsourcecode
Itsourcecode online House Rental System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_house_rental_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online House Rental System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online House Rental System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-02T15:11:59.071Z

Reserved: 2026-05-31T10:18:54.856Z

Link: CVE-2026-10251

cve-icon Vulnrichment

Updated: 2026-06-02T15:11:54.301Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T13:16:29.083

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10251

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T16:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')