CVE-2024-5366

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file edit-cate.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266278 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best House Rental Management System	1.0
sourcecodester	house-rental-and-property-listing-php-full-source-code	1.0

References

https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-4.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.266278Permissions Required, VDB Entry
https://vuldb.com/?id.266278Third Party Advisory, VDB Entry
https://vuldb.com/?submit.343433Third Party Advisory, VDB Entry
https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-4.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.266278Permissions Required, VDB Entry
https://vuldb.com/?id.266278Third Party Advisory, VDB Entry
https://vuldb.com/?submit.343433Third Party Advisory, VDB Entry

Timeline

Published: May 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-53676.1A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processi CVE-2024-536726.3A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o CVE-2024-536739.8A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-536747.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536757.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536769.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.CVE-2024-536779.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums CVE-2024-536788.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data CVE-2024-536795.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A CVE-2024-53686.1A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function CVE-2024-536805.5In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()CVE-2024-536815.5In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats