SourceCodester Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_payment function within /admin_class.php. This vulnerability allows remote attackers with high privileges to manipulate the ID argument, potentially leading to unauthorized data access or modification. Public exploit code is available, increasing the risk of exploitation.