The flaw in itsourcecode Online House Rental System 1.0 resides in the manage_payment.php script. By manipulating the ID argument, an attacker can inject arbitrary SQL, making the vulnerability exploitable remotely. The exploit is publicly disclosed and may be used against exposed instances.

itsourcecode Online House Rental System version 1.0 is affected, with the flaw located in the /manage_payment.php file. No other versions or products are listed.

With a CVSS score of 6.9 the flaw falls into the medium severity range. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not in the CISA KEV catalog. Attack vectors are remote over the web, requiring access to the application, and exploitation would entail manipulation of the ID parameter to inject SQL. Because the exploit is public, attackers may attempt automated attacks against exposed instances.