CVE-2025-12614
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. The delete_payment function in /admin_class.php is affected, where manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially resulting in data leakage or deletion. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update the system to a patched version as soon as possible or implement proper input filtering. Also restrict access to the admin panel.
Other vulnerabilities in Best House Rental Management System
See all- CVE-2025-12853Medium
A SQL Injection vulnerability was determined in SourceCodester Best House Rental Management System 1.0 in the delete_house function of /admin_class.php via manipulation of the ID argument. The attack can be performed remotely and a public exploit is available.
- CVE-2025-12598Medium
A flaw has been found in SourceCodester Best House Rental Management System 1.0. The save_tenant function in /admin_class.php is affected, where manipulation of the firstname argument can lead to SQL injection. The attack can be launched remotely and the exploit has been published. Other parameters might also be affected.
- CVE-2025-12597Medium
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. The save_category function in /admin_class.php is affected, where manipulation of the Name argument results in SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS