This vulnerability in Montodel House-Rental-Management involves SQL injection via the ID argument in the /index.php?page=houses file. The injection flaw allows remote attackers to execute unauthorized SQL commands by manipulating the parameter. Due to the product's rolling release model, exact affected versions cannot be specified. The vendor was notified but did not provide any response or patch information. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or mitigation guidance is currently available.

Successful exploitation could allow an attacker with low privileges to remotely execute SQL injection attacks, potentially leading to partial compromise of data confidentiality, integrity, and availability. The CVSS vector indicates low impact on confidentiality, integrity, and availability, but the vulnerability still poses a risk of unauthorized database queries or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing application-layer protections such as input validation, parameterized queries, or web application firewalls to mitigate SQL injection risks until an official fix is released.