CVE-2026-10251 itsourcecode CVE debrief

Who should care

Organizations operating instances of itsourcecode Online House Rental System 1.0, security teams managing PHP-based rental management applications, and defenders responsible for web application security monitoring.

Technical summary

The itsourcecode Online House Rental System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=login endpoint. The Username parameter accepts unsanitized input that is incorporated into SQL queries without proper parameterization or escaping. Remote attackers can exploit this weakness to manipulate database queries. The CVSS 4.0 score of 5.5 reflects network accessibility, low attack complexity, and limited confidentiality, integrity, and availability impacts. Public exploit availability is noted in the source metadata, elevating practical risk. The weakness classifications include CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Defensive priority

medium

Recommended defensive actions

• Apply input validation and parameterized queries to the Username parameter in /ajax.php?action=login
• Restrict network access to the affected application if patching is not immediately feasible
• Monitor database query logs for anomalous patterns indicative of SQL injection attempts
• Review and update web application firewall rules to detect SQL injection payloads targeting login endpoints
• Verify vendor attribution and seek official patch from itsourcecode when available

Evidence notes

Vulnerability identified in itsourcecode Online House Rental System 1.0. Affected endpoint: /ajax.php?action=login. Vulnerable parameter: Username. Attack vector: remote. Public exploit availability confirmed per source metadata. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (Improper Neutralization of Special Elements in SQL Command) identified as weakness classifications. Vendor attribution derived from reference domain candidate 'Itsourcecode' with low confidence; canonical source marked as reference_domain_weak. NVD status: Deferred.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.