Online House Rental System CVE-2026-10253

Exploitation requires only that an attacker can reach the /manage_payment.php endpoint over the network and submit a manipulated 'ID' parameter; no authentication, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N). The limiting factor is exposure: the application must be deployed and reachable by the attacker, and the specific affected version is itsourcecode Online House Rental System 1.0 running on a PHP/MySQL stack. Because the endpoint name 'manage_payment.php' suggests an administrative function, some deployments may already restrict it behind authentication at the web-server or reverse-proxy layer, which would block exploitation despite the application-level flaw.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L scores 7.3 (High) and signals network reachable, low-complexity, unauthenticated exploitation with partial impact on confidentiality, integrity, and availability. The E:P/RC:R temporal metrics confirm a Proof-of-Concept exploit with reasonable confidence in reporting, aligning with the publicly available exploit referenced on GitHub. The CVE is NOT listed in CISA KEV and no EPSS score was supplied in the intelligence package, so widespread automated exploitation cannot be confirmed from the available data. Real-world risk is moderate-to-high for any internet-exposed instance: the prerequisites are trivial, but itsourcecode applications are typically deployed in low-value academic/demo environments rather than large enterprises, which tempers aggregate impact. Defenders should treat any exposed instance as compromiseable until patched or removed.

An attacker discovers an internet-exposed Online House Rental System instance via Shodan or Google dorking for distinctive itsourcecode markup, then issues a request such as GET /manage_payment.php?ID=1' UNION SELECT username,password FROM users-- to exfiltrate administrator credentials from the backend database. With the publicly available exploit code referenced at https://github.com/zhengdexu-bot/zhengdexu/issues/5, even unskilled attackers can replicate the attack against the default configuration.