CVE-2026-10251: SQL Injection in itsourcecode Online House Rental System 1.0

Technical summary

CVE-2026-10251 is a SQL injection flaw (CWE-89) in the /ajax.php?action=login endpoint of itsourcecode Online House Rental System 1.0. The Username parameter fails to properly sanitize or parameterize user input before constructing SQL queries. This improper input handling (CWE-74) allows unauthenticated, remote attackers to inject malicious SQL syntax with no user interaction required. The vulnerability carries a CVSS v3.1 score of 7.3 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network-exploitable impact on confidentiality, integrity, and availability.

Business impact

Successful exploitation could allow attackers to extract sensitive tenant or landlord information (names, contact details, financial records), modify or delete rental records, or degrade system availability. For property management organizations using this system, data breaches expose customer privacy and create regulatory compliance risks. Attackers may also establish persistence for further lateral movement if the system is networked with internal infrastructure.

Affected systems

itsourcecode Online House Rental System version 1.0 is confirmed vulnerable. Organizations running this specific version should immediately audit their deployment scope and network exposure. Verify whether your systems are running this version and whether instances are accessible from untrusted networks or the internet.

Exploitability

This vulnerability has high exploitability. It requires no authentication, no user interaction, and network access only—all factors that make it practical to exploit at scale. Public exploit code is available, meaning threat actors have pre-built tools to test and target unpatched systems. The unauthenticated nature and network accessibility significantly lower the barrier to entry for attackers.

Remediation

Patch or upgrade itsourcecode Online House Rental System to a version released after this vulnerability's disclosure. Consult the vendor's official advisory for specific patched versions. Until patching is possible, restrict network access to the affected application using firewall rules or WAF policies, disable the /ajax.php endpoint if not required, and implement IP allowlisting for legitimate administrative access.

Patch guidance

Contact itsourcecode for an official security update addressing CVE-2026-10251. Verify the patched version number against the vendor's advisory before deployment. Test patches in a non-production environment first to ensure compatibility with your rental operations. After patching, restart the affected service to activate the fixes.

Detection guidance

Monitor HTTP requests to /ajax.php?action=login for suspicious patterns in the Username parameter, including SQL metacharacters (single quotes, semicolons, comment markers like -- or /*). Configure WAF rules to block or alert on SQL injection signatures in login attempts. Review database query logs for unusual or malformed SQL statements originating from the web application. Check application logs for authentication failures or error messages that may indicate injection attempts.

Why prioritize this

This vulnerability merits immediate attention due to its remote, unauthenticated exploitability, publicly available exploit code, and direct impact on sensitive data. The HIGH CVSS score reflects meaningful risk to confidentiality, integrity, and availability. Organizations should prioritize patching or mitigation within days, not weeks, particularly if the system handles personal or financial information.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects the combination of network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and impacts across confidentiality, integrity, and availability (C:L/I:L/A:L). The availability of public exploits and lack of barriers to exploitation elevate real-world risk beyond the base score.

Frequently asked questions