CVE-2026-10252: itsourcecode Online House Rental System manage_tenant.php sql injection

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove itsourcecode Online House Rental System 1.0 from your environment.

   If the application or this component is not required, uninstall or remove the affected application/component from the web server to eliminate the vulnerable code.

2. Configuration

   Modify /manage_tenant.php so the ID argument is validated (e.g., numeric whitelist) and used only in parameterized/prepared SQL statements (no string-concatenated SQL). Apply proper input sanitization and output encoding as needed.

   itsourcecode Online House Rental System - /manage_tenant.php id_parameter_handling = use parameterized queries and validate/whitelist input
3. Configuration

   Temporarily disable or remove the manage_tenant.php endpoint (or deny HTTP requests to it) until a secure code fix is implemented to eliminate the SQL injection vulnerability.

   itsourcecode Online House Rental System - /manage_tenant.php manage_tenant_endpoint_enabled = false
4. Compensating control

   Restrict access to the management interface (including /manage_tenant.php) to trusted IPs or a VPN and deploy a Web Application Firewall (WAF) rule to block SQL injection payloads targeting the ID parameter as an interim mitigation.

5. Operational

   Search logs for exploitation indicators, review application and database integrity, and rotate any database and application credentials that may have been exposed. Restore from known-good backups if compromise is detected and apply code fixes before returning the endpoint to service.

Event History

Frequently Asked Questions