An input on the admin rent management page of the Storage Unit Rental Management System can be manipulated to inject arbitrary SQL commands, allowing an attacker to read, modify, or delete data in the database. This compromise of data confidentiality and integrity is a classic input validation failure identified as CWE‑89.

The vulnerability is identified in SourceCodester Storage Unit Rental Management System version 1.0. No other versions or vendor-specific details are documented, so the impact is limited to installations of this specific open‑source package.

The CVSS score of 2.7 indicates low severity, and the lack of an EPSS value or KEV listing suggests limited public exploitation. The likely attack vector assumes the attacker already has access to the administrative rent page—authentication or elevated privileges are required. No public exploits are cited, so exploitation would rely on sending crafted HTTP requests to the vulnerable endpoint to manipulate the SQL query.