CVE-2026-12775
Received Received - Intake
SQL Injection in Montodel House-Rental-Management

Publication date: 2026-06-21

Last updated on: 2026-06-21

Assigner: VulDB

Description
A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-21
Last Modified
2026-06-21
Generated
2026-06-21
AI Q&A
2026-06-21
EPSS Evaluated
N/A
NVD
CVE-2026-12775
EUVD
EUVD-2026-38141
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection issue found in the Montodel House-Rental-Management application, specifically in the /login.php file. It occurs due to improper validation of the 'Username' parameter, which allows attackers to inject malicious SQL code into the database queries.

An attacker can exploit this remotely to manipulate database queries, potentially gaining unauthorized access to sensitive data or compromising the system.

Impact Analysis

This vulnerability can have several serious impacts including unauthorized access to sensitive information, data tampering, potential system compromise, and disruption of services.

  • Unauthorized access to sensitive data
  • Data tampering or modification
  • Potential full system compromise
  • Service disruption or denial
Detection Guidance

This vulnerability can be detected by testing the 'username' parameter in the /login.php file for SQL injection flaws. A common method is to use time-based blind SQL injection payloads to observe delays in server response, indicating successful injection.

For example, you can use tools like sqlmap or manual curl commands with payloads that cause time delays to test if the input is vulnerable.

  • Using sqlmap: sqlmap -u "http://target/login.php" --data="username=admin&password=pass" --technique=T --time-sec=5
  • Manual curl test with time delay payload: curl -X POST -d "username=admin' OR IF(SLEEP(5),1,0)-- &password=pass" http://target/login.php
Mitigation Strategies

Immediate mitigation steps include implementing prepared statements with parameter binding to prevent SQL injection.

Additionally, strict input validation should be enforced on the 'username' parameter to block malicious input.

Minimizing database user permissions to limit the impact of a potential exploit is also recommended.

Conducting regular security audits to identify and fix vulnerabilities proactively is advised.

Compliance Impact

The SQL injection vulnerability in Montodel House-Rental-Management allows unauthorized access to sensitive data, data tampering, and potential system compromise. Such unauthorized access and data breaches can lead to violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information. Failure to remediate this vulnerability could result in non-compliance with these standards due to compromised data confidentiality and integrity.

Mitigation measures such as implementing prepared statements, strict input validation, minimizing database user permissions, and conducting regular security audits are essential to maintain compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart