CVE-2026-37591
SQL Injection in Storage Unit Rental System Admin Panel
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | storage_unit_rental_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Storage Unit Rental Management System v1.0 by Sourcecodester has an SQL injection vulnerability in the file /storage/admin/tenants/view_details.php.
This vulnerability occurs because the URL parameter 'id' is not properly sanitized, allowing an attacker to inject malicious SQL code.
For example, an attacker can send a specially crafted request with a payload that uses a UNION-based SQL injection to retrieve sensitive information such as the current database name.
The injection happens via a GET request and can be performed within an authenticated session, enabling arbitrary SQL commands to be executed on the backend MySQL database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Storage Unit Rental Management System v1.0 allows attackers to extract sensitive database information and potentially manipulate data without authorization.
Such unauthorized access and potential data leakage can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, exploitation of this vulnerability could result in violations of these standards due to compromised confidentiality and integrity of stored data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL injection vulnerability in the Storage Unit Rental Management System v1.0, immediate steps include sanitizing and validating the input parameter `id` in the `/storage/admin/tenants/view_details.php` file to prevent injection of arbitrary SQL commands.
Restricting or disabling direct user input in the `id` parameter or using prepared statements with parameterized queries can help prevent exploitation.
Additionally, limiting access to the vulnerable page to only trusted and authenticated users, and monitoring for suspicious activity in the application logs, can reduce risk.
Applying any available patches or updates from the vendor or developer is also recommended once available.
How can this vulnerability impact me? :
This SQL injection vulnerability can allow attackers to extract sensitive information from the database, such as database names and potentially other confidential data.
Attackers may also manipulate or delete data within the storage_db database, leading to data leakage, unauthorized data modification, or disruption of the system's normal operations.
Because the injection can be performed within an authenticated session, attackers who gain access to a valid session can exploit this vulnerability more easily.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by sending crafted HTTP GET requests to the vulnerable URL parameter and observing the response for SQL injection behavior.
For example, you can test the parameter `id` in the URL `/storage/admin/tenants/view_details.php?id=` by injecting a payload such as:
- /storage/admin/tenants/view_details.php?id=0' union select 1,database(),3,4,5,6,7,8,9,10--+
This payload attempts a UNION-based SQL injection to retrieve the current database name. If the response contains the database name or unusual output, it indicates the presence of the vulnerability.
You can use command-line tools like curl to perform this test, for example:
- curl -i "http://target/storage/admin/tenants/view_details.php?id=0' union select 1,database(),3,4,5,6,7,8,9,10--+" -b "PHPSESSID=your_session_id"
Replace `http://target` with your target system's address and `your_session_id` with a valid PHP session cookie if authentication is required.