CVE-2026-12776
Received Received - Intake
SQL Injection in Montodel House-Rental-Management

Publication date: 2026-06-21

Last updated on: 2026-06-21

Assigner: VulDB

Description
A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?page=houses. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-21
Last Modified
2026-06-21
Generated
2026-06-21
AI Q&A
2026-06-21
EPSS Evaluated
N/A
NVD
CVE-2026-12776
EUVD
EUVD-2026-38142
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw found in Montodel House-Rental-Management, specifically in the file /index.php?page=houses. It occurs due to insufficient input validation of the 'id' parameter, which allows an attacker to manipulate the SQL query executed by the application.

An attacker can exploit this vulnerability remotely by injecting malicious SQL code, potentially gaining unauthorized access to the database, tampering with data, or leaking sensitive information.

Impact Analysis

This vulnerability can have serious impacts including unauthorized database access, data tampering, leakage of sensitive information, and potential full system compromise.

  • Unauthorized access to sensitive data stored in the database.
  • Modification or deletion of critical data.
  • Potential takeover of the affected system by attackers.
Compliance Impact

This SQL injection vulnerability allows unauthorized database access, data tampering, and sensitive information leakage. Such security breaches can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive data against unauthorized access and ensure data integrity.

Failure to address this vulnerability could result in exposure of personal data, violating data protection requirements and potentially leading to legal and financial consequences under these regulations.

Detection Guidance

This SQL injection vulnerability can be detected by testing the 'id' parameter in the /index.php?page=houses endpoint for injection flaws.

Common detection methods include using boolean-based blind or time-based blind SQL injection techniques to observe changes in the application's response or response time.

  • Use payloads that manipulate the 'id' parameter to test for SQL injection, such as appending ' OR 1=1-- to the parameter value.
  • Example command using curl to test for SQL injection: curl "http://target/index.php?page=houses&id=1' OR '1'='1"
  • Use automated tools like sqlmap to scan the target URL for SQL injection vulnerabilities: sqlmap -u "http://target/index.php?page=houses&id=1" --batch
Mitigation Strategies

Immediate mitigation steps include implementing strict input validation on the 'id' parameter to prevent malicious SQL code from being executed.

Use prepared statements with parameter binding in the database queries to avoid direct injection of user input.

Minimize database user permissions to limit the potential impact of a successful injection.

Conduct regular security audits and code reviews to identify and fix similar vulnerabilities.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart