A flaw in the /index.php?page=houses page of Montodel House‑Rental‑Management allows attackers to manipulate the ID argument so that arbitrary SQL commands are executed. This is an instance of unchecked input (CWE-74) combined with unparameterized queries (CWE-89). The result is that an attacker can read, modify, or delete records stored in the application’s database, jeopardizing the confidentiality and integrity of tenant and property data.

Montodel’s House‑Rental‑Management product, up to the code revision 90010017b81265eb1ef3810268909f7719a33863, is affected. The product follows a rolling release model, so later releases may contain a fix, but specific version information is currently unavailable and the vendor has not responded to disclosure.

The CVSS score is 5.3, indicating moderate severity, and the Exploit Prediction Scoring System (EPSS) score is not available; the issue is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by crafting a malicious ID value sent to the index page. The published exploit demonstrates that any attacker with network access to the web server can insert SQL fragments, potentially retrieving or altering database contents. Without an official patch, the risk remains present for all deployments awaiting an updated release.