CVE-2025-12853
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A SQL Injection vulnerability was determined in SourceCodester Best House Rental Management System 1.0 in the delete_house function of /admin_class.php via manipulation of the ID argument. The attack can be performed remotely and a public exploit is available.
Risk Assessment
An attacker can remotely inject SQL queries, potentially leading to data leakage or modification. Public exploit availability increases the risk of exploitation.
Recommendation
Update Best House Rental Management System to a patched version or disable the vulnerable component. Also deploy WAF rules to filter SQL Injection attempts.
Other vulnerabilities in Best House Rental Management System
See all- CVE-2025-12614Medium
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. The delete_payment function in /admin_class.php is affected, where manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2025-12598Medium
A flaw has been found in SourceCodester Best House Rental Management System 1.0. The save_tenant function in /admin_class.php is affected, where manipulation of the firstname argument can lead to SQL injection. The attack can be launched remotely and the exploit has been published. Other parameters might also be affected.
- CVE-2025-12597Medium
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. The save_category function in /admin_class.php is affected, where manipulation of the Name argument results in SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS