Description
A security vulnerability has been detected in itsourcecode Online House Rental System 1.0. This affects an unknown function of the file /manage_tenant.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-06-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An injection flaw exists in the Online House Rental System 1.0, specifically in an unidentified function within /manage_tenant.php. Manipulating the ID parameter allows an attacker to insert arbitrary SQL commands, leading to unauthorized data access or modification. The flaw is a classic SQL injection vulnerability (CWE-89) and may also involve malformed input issues (CWE-74). The effect is a direct compromise of database integrity and confidentiality, potentially exposing tenant records. This is an exploitable weakness that could be leveraged without needing local access.

Affected Systems

The affected product is itsourcecode Online House Rental System release 1.0. The vulnerability originates from the /manage_tenant.php component; no other versions or modules are explicitly listed as impacted.

Risk and Exploitability

The CVSS score of 6.9 classifies this as a moderate severity vulnerability. EPSS information is unavailable, but the exploit has been publicly disclosed, indicating a non-zero chance of exploitation from any remote host capable of interacting with the web interface. The vulnerability is not included in the CISA KEV catalog, yet its remote nature and potential data leakage warrant proactive attention. An attacker with network connectivity to the application can supply a crafted ID value to inject malicious SQL and either read sensitive tenant data or alter the database state.

Generated by OpenCVE AI on June 1, 2026 at 15:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor fix or patch that updates /manage_tenant.php to properly validate and sanitize the ID parameter, preferably by using parameterized queries or prepared statements.
  • If a vendor patch is not yet available, enforce server-side validation of the ID parameter to allow only numeric characters, rejecting or escaping any other input before it is processed.
  • Configure a web application firewall to block or rate limit requests that contain common SQL injection payloads targeting the ID parameter in /manage_tenant.php.

Generated by OpenCVE AI on June 1, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 03 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 13:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Online House Rental System 1.0. This affects an unknown function of the file /manage_tenant.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title itsourcecode Online House Rental System manage_tenant.php sql injection
First Time appeared Itsourcecode
Itsourcecode online House Rental System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_house_rental_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online House Rental System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online House Rental System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-03T18:07:10.202Z

Reserved: 2026-05-31T10:18:57.354Z

Link: CVE-2026-10252

cve-icon Vulnrichment

Updated: 2026-06-03T18:06:55.983Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T13:16:29.240

Modified: 2026-06-01T15:15:37.293

Link: CVE-2026-10252

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-02T20:54:40Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')