This vulnerability involves SQL injection in the itsourcecode Online House Rental System 1.0, specifically related to the ID parameter in the /manage_tenant.php file. An attacker can remotely manipulate this parameter to inject malicious SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or fix has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium given the limited scope of confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce risk. Monitor vendor channels for updates and apply official patches promptly once released.