PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10253 itsourcecode CVE debrief

A SQL injection vulnerability exists in itsourcecode Online House Rental System 1.0, specifically within the /manage_payment.php file. The ID parameter is susceptible to manipulation, allowing remote attackers to inject arbitrary SQL commands. The vulnerability was disclosed publicly on 2026-06-01 and is rated MEDIUM severity with a CVSS score of 5.5. The exploit is publicly available, increasing the risk of active exploitation. The vendor attribution is based on weak reference domain evidence (itsourcecode) and requires review for confirmation. No known ransomware campaign use or CISA KEV listing is present.

Vendor
itsourcecode
Product
Online House Rental System
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running itsourcecode Online House Rental System 1.0, particularly those exposing /manage_payment.php to untrusted networks. Web application security teams, PHP application developers, and property management software operators should prioritize patching or implementing defensive controls.

Technical summary

The vulnerability is a SQL injection (CWE-89) in the /manage_payment.php endpoint of itsourcecode Online House Rental System 1.0. The ID parameter accepts unsanitized user input that is concatenated into SQL queries. Attackers can exploit this remotely without authentication to manipulate database queries. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no required privileges, and no user interaction, with low impacts to confidentiality, integrity, and availability. The exploit has been publicly disclosed, though the vulnerability status in NVD is currently Deferred.

Defensive priority

medium

Recommended defensive actions

  • Apply input validation and parameterized queries to the ID parameter in /manage_payment.php
  • Restrict network access to the administrative payment management interface if not required externally
  • Monitor web application logs for suspicious SQL injection patterns targeting /manage_payment.php
  • Contact itsourcecode for official patch availability and apply updates when released
  • Review database user privileges to enforce least privilege and limit impact of successful injection

Evidence notes

Vulnerability disclosed via VulDB and NVD on 2026-06-01. Public exploit reference available through GitHub issue. Vendor identification derived from reference domain candidate with low confidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10253 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10253

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10253 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10253

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.