CVE-2025-12598
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw has been found in SourceCodester Best House Rental Management System 1.0. The save_tenant function in /admin_class.php is affected, where manipulation of the firstname argument can lead to SQL injection. The attack can be launched remotely and the exploit has been published. Other parameters might also be affected.
Risk Assessment
An attacker could remotely inject malicious SQL code, potentially leading to unauthorized data access or modification. The public exploit increases the likelihood of attack.
Recommendation
Immediately update the application to a patched version or implement input validation. Also monitor network traffic for SQL injection attempts.
Other vulnerabilities in Best House Rental Management System
See all- CVE-2025-12853Medium
A SQL Injection vulnerability was determined in SourceCodester Best House Rental Management System 1.0 in the delete_house function of /admin_class.php via manipulation of the ID argument. The attack can be performed remotely and a public exploit is available.
- CVE-2025-12614Medium
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. The delete_payment function in /admin_class.php is affected, where manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2025-12597Medium
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. The save_category function in /admin_class.php is affected, where manipulation of the Name argument results in SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS