An SQL injection flaw exists in the admin tenant view page of Sourcecodester Storage Unit Rental Management System v1.0. The flaw allows an attacker to inject arbitrary SQL code through unsanitized input in view_details.php, potentially leading to unauthorized read or modification of tenant data. The weakness corresponds to CWE-89, which describes the exploitation of unsanitized user data in database queries.

Systems running Sourcecodester Storage Unit Rental Management System version 1.0 are affected. The known vulnerable file is /storage/admin/tenants/view_details.php, which is part of the administrative interface used by site operators to manage tenant records.

The CVSS base score is 2.7, indicating low overall risk. Exploit Probability Service Score data is not available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Successful exploitation would likely require access to the administration area, suggesting that authentication is a prerequisite. Thus the attack vector is inferred to be remote with authenticated user, and the likelihood of exploitation remains low based on the supplied metrics.