This vulnerability in Montodel House-Rental-Management involves SQL injection through the Username argument in /login.php. An attacker can remotely inject SQL commands due to insufficient input validation or sanitization. The product's rolling release model prevents identification of exact affected versions. No vendor response or patch information is available, and the exploit is publicly disclosed. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. As a temporary measure, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Username parameter in /login.php may reduce risk.