The vulnerability is a classic SQL injection discovered in the endpoint /storage/admin/tenants/view_details.php of the Storage Unit Rental Management System. This flaw allows an attacker to inject arbitrary SQL statements, potentially revealing sensitive tenant information or altering database contents. The quality of the weakness corresponds to the typical SQL injection category.

Only the Sourcecodester Storage Unit Rental Management System version 1.0 is known to contain the affected file. No other vendors, products, or versions are listed, so deployments that run this exact version and expose the admin view are exposed.

Because the injection exists in an admin‑level page, the attacker would need to reach that URL, usually by accessing the site’s web interface or by sending a crafted HTTP request. No CVSS score or EPSS data is provided, and the vulnerability is not listed in the KEV catalog, so the exact risk level is unclear. Nevertheless, the exploitability of SQL injection hinges on the attacker’s ability to authenticate as an admin or to bypass authentication, and it could lead to full data compromise if successful.