CVE-2024-0502 is a medium severity SQL injection vulnerability in SourceCodester House Rental Management System 1.0, scored CVSS 4.7. It affects manage_user.php through the id/name/username argument. No fixed version is named in the record, so check the vendor or project.
What's affected
The record names SourceCodester House Rental Management System, version 1.0. The weakness is tracked as CWE-89. The affected code is manage_user.php in the Edit User. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-13 and the VulDB identifier is VDB-250610.
The record does not name a fixed version, and we could not retrieve the VulDB entry or the linked researcher write up to confirm one. Treat the product as unpatched until the vendor or project tells you otherwise.
How to check if you're exposed
Start with an inventory question: do you run SourceCodester House Rental Management System at all? These are small standalone web applications, so they rarely show up in a package manager. Look for them as deployed source trees, not as installed packages. Check web roots, shared hosting accounts, internal tools servers and any container images built from a download of the project.
If you find a copy, confirm the version. The record lists 1.0. Then confirm that manage_user.php exists in your tree. A command like this, run from the server or a checked out copy, will show whether the file is present:
grep -rn "manage_user.php" /var/www
If the file is present, assume the copy is affected until you have evidence otherwise. We have not seen a vendor advisory that describes a detection method, so there is no official check to point you to. Review the application's access logs for requests to that path from unexpected sources, and compare against normal use. Unusual or failing requests to a single page are worth a closer look. A log review cannot prove a copy was not abused, but it can help you scope the review.
Dependency scanners will not find a standalone application like this by itself. You can still use the free in-browser dependency scan at gold.safeguard.sh/scan on any project that vendors it as a library, and the Gold directory entry for CVE-2024-0502 tracks the record as it changes.
What to do now
- Find every deployed copy of SourceCodester House Rental Management System, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers 1.0.
- Check the vendor or project page for a fixed release. We could not confirm one, so do not assume it exists.
- If the application does not need to be reachable from the internet, move it behind a VPN or an allow list of known addresses now.
- Treat input handling in the affected code as untrusted. If you can maintain the source, replace string built queries with parameterized queries for the affected page and every similar page.
- If you cannot patch and the software is not essential, plan to retire or replace it. Unmaintained sample style projects are poor candidates for holding real data.
Why it matters
SQL injection happens when an application builds a database query by pasting user input into the query text. The database then cannot tell the application's own query logic from the data a visitor supplied. Depending on the account the application uses to talk to the database, the consequences can include reading rows the user should never see, changing records, or in the worst cases going further. The advisory text for this record only says the manipulation of the id/name/username argument leads to SQL injection. It does not describe the database account or what data sits behind it, so we will not guess at impact beyond that.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue critical. The CVSS 3.1 base score attached to the record is 4.7, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. Both are accurate descriptions of the same record, and they use different scales. For triage we use the CVSS score and the exposure of your own deployment. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-0502 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0502 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The description does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of House Rental Mgmt System?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0502
- NVD record for CVE-2024-0502, including the VulDB entry VDB-250610, as summarized in the Safeguard record file (we could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed)
Last reviewed: 19 October 2026.
