SourceCodester Best House Rental Management System 1.0 contains a SQL injection vulnerability in the save_tenant function within the /admin_class.php file. The vulnerability arises from improper handling of the firstname argument, allowing remote attackers with high privileges to manipulate SQL queries. Exploit code for this vulnerability has been published. The vulnerability has a medium severity rating with a CVSS score of 4.7.