CVE-2025-12597
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. The save_category function in /admin_class.php is affected, where manipulation of the Name argument results in SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially resulting in data leakage or modification. The public availability of the exploit increases the risk.
Recommendation
Update the system to a patched version as soon as possible or implement input filtering. Also restrict access to the admin panel.
Other vulnerabilities in Best House Rental Management System
See all- CVE-2025-12853Medium
A SQL Injection vulnerability was determined in SourceCodester Best House Rental Management System 1.0 in the delete_house function of /admin_class.php via manipulation of the ID argument. The attack can be performed remotely and a public exploit is available.
- CVE-2025-12614Medium
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. The delete_payment function in /admin_class.php is affected, where manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2025-12598Medium
A flaw has been found in SourceCodester Best House Rental Management System 1.0. The save_tenant function in /admin_class.php is affected, where manipulation of the firstname argument can lead to SQL injection. The attack can be launched remotely and the exploit has been published. Other parameters might also be affected.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS