CVE-2024-5365

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in SourceCodester Best House Rental Management System up to 1.0. This affects an unknown part of the file manage_payment.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266277 was assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best House Rental Management System	1.0

References

https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-3.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.266277Permissions Required, VDB Entry
https://vuldb.com/?id.266277Third Party Advisory, VDB Entry
https://vuldb.com/?submit.343432Third Party Advisory, VDB Entry
https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-3.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.266277Permissions Required, VDB Entry
https://vuldb.com/?id.266277Third Party Advisory, VDB Entry
https://vuldb.com/?submit.343432Third Party Advisory, VDB Entry

Timeline

Published: May 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-536514.6A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (C CVE-2024-53666.5A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerabilit CVE-2024-53676.1A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processi CVE-2024-536726.3A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o CVE-2024-536739.8A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-536747.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536757.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536769.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.CVE-2024-536779.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums CVE-2024-536788.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data CVE-2024-536795.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A CVE-2024-53686.1A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function