Online House Rental System EUVD-2026-33628

The target must be running itsourcecode Online House Rental System 1.0 with /manage_tenant.php reachable by the attacker - typically the admin/management interface of the application. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so any network-reachable instance is exploitable in its default configuration. Practical limits: the application is a niche PHP project with a small installed base, so exploitation depends on the defender actually deploying it and exposing the manage_tenant.php path; deployments behind a WAF, on internal-only networks, or with the management endpoint access-restricted reduce reachability.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) reflects an attack reachable over the network with low complexity, no privileges, and no user interaction - but only partial (Low) impact across confidentiality, integrity, and availability, which is conservative for SQLi since real-world UNION-based or stacked-query exploitation often yields full database compromise. The temporal vector includes E:P (Proof-of-Concept) and RC:R (Reasonable confidence), consistent with the publicly available exploit referenced on GitHub. There is no CISA KEV listing and no EPSS score provided in the input, so widespread active exploitation is not confirmed; however, this is the type of low-effort SQLi target that mass scanners and automated exploitation toolkits routinely sweep. Realistic risk is meaningful only for organizations actually running this niche application - for the broader population this is unlikely to be a priority, but for any exposed instance it should be treated as critical given trivial exploitability and public PoC.

An attacker locates an exposed Online House Rental System instance via Shodan or Google dorking, then issues an HTTP request to /manage_tenant.php?id=1' UNION SELECT username,password,3,4 FROM users-- to dump credential material from the backend database. Because publicly available exploit code exists, this can be automated and run at scale against any internet-facing deployments, with no authentication or user interaction required.