Which versions of Online House Rental System are affected by EUVD-2026-33631?

itsourcecode Online House Rental System 1.0 is vulnerable to unauthenticated SQL injection in the payment management function (/manage_payment.php), enabling remote attackers to manipulate the…

Is there a public PoC exploit available for EUVD-2026-33631?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33631. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33631?

24 hours: Identify and audit all instances of itsourcecode Online House Rental System 1.0 in production; restrict network access to /manage_payment.php via firewall or disable the function entirely if not actively required. 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns on the 'ID' parameter; implement input validation and parameterized query enforcement; isolate the application to internal-only network access. 30 days: Evaluate and migrate to a patched, modern rental management platform; contact the itsourcecode vendor to confirm whether a security update will be released or if the product is end-of-life.

Online House Rental System EUVD-2026-33631

Q: What is the CVSS score of EUVD-2026-33631?

EUVD-2026-33631 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10253 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-m8hx-5wq3-4vg7

PHP SQLi Online House Rental System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 13:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 13:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 13:15 vuln.today

DescriptionCVE.org

A vulnerability was detected in itsourcecode Online House Rental System 1.0. This impacts an unknown function of the file /manage_payment.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Online House Rental System 1.0 allows remote unauthenticated attackers to manipulate the 'ID' parameter of /manage_payment.php to execute arbitrary database queries. Publicly available exploit code exists, increasing the likelihood of opportunistic attacks against exposed deployments. The flaw was reported by VulDB and impacts a PHP-based rental management application commonly deployed by small operators and educational projects.

Technical ContextAI

The affected software is a PHP-based web application (cpe:2.3:a:itsourcecode:online_house_rental_system:*) distributed by itsourcecode, a vendor that publishes source-code projects often used for academic or small-business deployments. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical root cause for SQL injection. The /manage_payment.php endpoint accepts an 'ID' parameter that is concatenated into a SQL query without proper parameterization or input sanitization, allowing an attacker to alter the structure of the underlying query against the backing database (typically MySQL/MariaDB in itsourcecode projects).

RemediationAI

No vendor-released patch identified at time of analysis; itsourcecode has not published a security advisory in the supplied references. As a primary mitigation, replace the vulnerable query in /manage_payment.php with parameterized queries (PDO prepared statements or mysqli_stmt_bind_param) and enforce strict integer casting on the ID parameter. As a compensating control, restrict access to /manage_payment.php to authenticated administrative users via session checks or a reverse-proxy ACL - note this will break any legitimate unauthenticated workflow that relies on the endpoint. Deploying a Web Application Firewall rule blocking SQL meta-characters in the ID parameter offers short-term protection but is bypassable and should not be the sole defense. Where the application is used only for coursework or testing, the most reliable remediation is to remove the instance from any internet-reachable network entirely; consult https://vuldb.com/vuln/367531 for additional context.