CVE-2026-10251: itsourcecode Online House Rental System ajax.php login sql injection
A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the server-side code for /ajax.php?action=login to validate and sanitize the Username argument and use prepared statements/parameterized SQL queries (or an ORM with parameterization) to eliminate SQL injection vectors.
itsourcecode Online House Rental System /ajax.php?action=login Username parameter handling = validate+santize and use parameterized queries - Configuration
If the AJAX login endpoint is not required, disable or remove /ajax.php?action=login (or disable the AJAX login feature) until the vulnerability is remediated.
itsourcecode Online House Rental System /ajax.php?action=login login endpoint availability = disabled until fixed - Compensating control
Until code is fixed, restrict remote access to /ajax.php?action=login using network controls (firewall/ACL) and/or deploy Web Application Firewall rules to block SQL injection attempts targeting the Username parameter.
- Operational
Search application and web server logs for signs of exploitation of /ajax.php?action=login, and if compromise is suspected rotate any potentially exposed credentials and investigate for unauthorized access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10251?
CVE-2026-10251 has a high severity rating of 7.3.
How does CVE-2026-10251 affect the itsourcecode Online House Rental System?
CVE-2026-10251 allows for SQL injection through the Username parameter in the /ajax.php?action=login function.
What can attackers do with CVE-2026-10251?
Attackers can exploit CVE-2026-10251 to execute malicious SQL commands remotely.
How do I fix CVE-2026-10251?
To fix CVE-2026-10251, ensure proper input validation and use prepared statements for SQL queries in the itsourcecode Online House Rental System.
When was CVE-2026-10251 published?
CVE-2026-10251 was published on June 1, 2026.