Vulnerability · Published Jun 17, 2024 · Assigned by VulDB
CVE-2024-6043SourceCodester Best House Rental Management System admin_class.php login sql injection
High 7.3
In plain English
A high-severity SQL injection in Best House Rental Management System from SourceCodester. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file admin_class.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268767.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Best House Rental Management System | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- VDB-268767 | SourceCodester Best House Rental Management System admin_class.php login sql injection vdb-entry, technical-description
- VDB-268767 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #358176 | SourceCodester SourceCodester Best house rental management system project in php 1.0 SQL Injection third-party-advisory
- https://github.com/yezzzo/y3/blob/main/SourceCodester%20Best%20house%20rental%20management%20system%20project%20in%20php%201.0%20SQL%20Injection.md exploit