EUVD-2026-38141
GHSA-w6qr-cjgp-ccf7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth login endpoint requires no privileges; low C/I/A reflects bounded database impact without confirmed full-system compromise or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Montodel House-Rental-Management's /login.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and interact with the underlying database without credentials. A public proof-of-concept exploit is available on GitHub, and the vendor was unresponsive to pre-disclosure contact, leaving no patch path. Any internet-exposed deployment of this PHP application should be treated as immediately at risk given the zero-barrier exploitation prerequisites and available exploit code.
Technical ContextAI
Montodel House-Rental-Management is a PHP-based property rental management web application (CPE: cpe:2.3:a:montodel:house-rental-management:*:*:*:*:*:*:*:*). The flaw is classified as CWE-89 (Improper Neutralization of Special Elements in an SQL Command), indicating the application directly interpolates the attacker-controlled Username parameter into a SQL query in /login.php without parameterization or adequate sanitization. In PHP applications, this typically occurs when developers use string concatenation to build queries rather than PDO or MySQLi prepared statements with bound parameters. Because the injection point is the pre-authentication login endpoint, no session token or user account is required to reach the vulnerable code path.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure, so no official fix version exists. The most reliable mitigation is to immediately replace the vulnerable string-concatenated SQL query in /login.php with a parameterized query using PHP PDO or MySQLi prepared statements with bound parameters, eliminating the injection surface at the code level. If a code-level fix cannot be deployed immediately, restrict access to /login.php via web server ACLs or firewall rules to trusted IP ranges only - this eliminates remote exploitation but also restricts legitimate users. Deploying a Web Application Firewall rule blocking SQL metacharacters (single quotes, UNION, double-dash comment sequences) in login form fields provides a secondary layer, though WAF bypass techniques exist and this is not a permanent fix. If the application is non-critical or unused, taking it offline entirely eliminates the attack surface until a code fix is applied. The public exploit is documented at https://github.com/yihaofuweng/cve/issues/67 and should be treated as active threat intelligence when assessing urgency.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today