This vulnerability in Montodel House-Rental-Management allows remote attackers to exploit an SQL injection flaw via the ID parameter in the /index.php?page=houses file. The injection enables unauthorized manipulation of the backend database. Due to the rolling release model, no explicit version ranges are identified as affected or fixed. The vendor has not issued any advisory or patch, and the remediation level is unknown. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and no privileges. However, the impact is rated medium due to limited scope and lack of confirmed widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. As a temporary measure, restricting access to the vulnerable endpoint or applying web application firewall (WAF) rules to detect and block SQL injection attempts may reduce risk.