CVE-2026-10251

Vulnerability

The Online House Rental System version 1.0 from itsourcecode contains a SQL injection vulnerability in the /ajax.php file when handling the action=login parameter. The Username parameter is directly concatenated into SQL queries without sanitization or parameterization, allowing an attacker to inject arbitrary SQL commands. The vulnerable file is located at /ajax.php?action=login. [1][2]

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to /ajax.php?action=login with a malicious Username parameter containing SQL injection payloads. No authentication or prior access is required. The exploit has been publicly disclosed with a proof-of-concept. [2]

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries on the database, leading to unauthorized access to sensitive data, data modification or deletion, and potentially full system compromise. The attacker can bypass authentication and gain control over the application's backend. [2]

Mitigation

As of the publication date, no official patch has been released by itsourcecode. Users should apply input validation and use prepared statements to mitigate the vulnerability. The software is no longer actively maintained? Not stated, but we can say no fix available. Alternatively, we can mention that the vendor has not responded. Since reference [1] is just the vendor homepage, no fix mentioned. So we write: "No official fix has been provided by the vendor. Users should implement input sanitization and use parameterized queries as a workaround." [1][2]