This vulnerability in Montodel House-Rental-Management up to commit 90010017b81265eb1ef3810268909f7719a33863 involves SQL injection through the Username argument in /login.php. The issue allows remote unauthenticated attackers to inject SQL commands, potentially compromising the database. The product's rolling release model prevents precise version identification. No vendor response or patch information is available, and the exploit code is publicly known.

Successful exploitation can lead to unauthorized database access or manipulation due to SQL injection. The vulnerability is remotely exploitable without authentication. The CVSS 4.0 base score is 6.9 (medium), reflecting low attack complexity and no required privileges or user interaction, but limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is known, users should monitor official Montodel communications for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /login.php Username parameter.