CVE-2024-2076 is a medium severity missing authentication flaw in CodeAstro House Rental Management System 1.0, scored CVSS 5.3. Pages named booking.php, owner.php and tenant.php are reachable without a proper login check. The record names no fixed version, so restrict access, review the code and check the vendor.
What's affected
The record names CodeAstro House Rental Management System version 1.0. The weakness is CWE-306, missing authentication for a critical function. The affected files are given as booking.php, owner.php and tenant.php, and the record says the attack can be launched remotely and that an exploit has been disclosed to the public. It was published on 2024-03-01 and the VulDB identifier is VDB-255392.
The CVSS 3.1 score is 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. No privileges and no user interaction are needed, but the impact is rated low on confidentiality only, with none on integrity or availability. The VulDB description text calls the issue problematic rather than critical, which matches a middling score.
The record does not name a fixed version. We did not retrieve the VulDB entry or the linked write up, which is hosted on a document sharing service, so we cannot confirm whether the vendor has patched it. Treat the product as unpatched.
How to check if you're exposed
Start by asking whether you run this application. It is a small standalone PHP project, so it will not appear in package manager output. Look for deployed source trees in web roots, hosting accounts and internal servers, and in container images built from a downloaded copy.
If you find one, confirm the version in the project files (the record lists 1.0) and confirm the three named pages exist:
find /var/www -name booking.php -o -name owner.php -o -name tenant.php
Then test the behavior in a safe way. From a private browser session where you are not logged in, request one of those pages on your own copy and see whether you are sent to a login page or shown content. Only do this on systems you own. Do not test other people's installations.
Review access logs for requests to those three pages from visitors who have no session. In a normal deployment you would expect those requests to follow a login. A lot of anonymous traffic to them is worth a closer look.
A dependency scanner will not find a standalone app by itself. You can still run the free in-browser dependency scan on any project that vendors this code, and the Gold page for CVE-2024-2076 tracks the record.
What to do now
- Find every copy of CodeAstro House Rental Management System, including staging and test servers.
- Confirm the version. The record covers 1.0.
- Check the vendor page for a fixed release. We could not confirm one.
- Put the application behind a VPN, an allow list or web server level authentication so that anonymous visitors cannot reach it.
- If you maintain the source, add an authentication check at the top of every page that shows or changes booking, owner or tenant data, and make it fail closed.
- Review what personal data the application holds, such as tenant details, and decide whether it belongs in an unmaintained project at all.
Why it matters
Missing authentication is a simple failure with a wide effect. A page that was written to serve a logged in user is reachable by anyone who knows its address. The application may check a session on some pages and forget on others, which is why the record lists three files rather than one. The fix is not a single patch, it is a rule that every page checks who is asking before it returns anything.
CVE-2024-2076 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild. The record does say an exploit is public. With a CVSS score of 5.3 the impact is limited to some loss of confidentiality, but rental software tends to hold names, contact details and booking records, so exposure still has a real cost for the people in the data.
Quick check
Is CVE-2024-2076 exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list. The record says an exploit has been disclosed publicly.
Is there a patch?
The record names no fixed version. Check the vendor, and restrict access in the meantime.
Sources
- Gold entry for CVE-2024-2076
- NVD record for CVE-2024-2076 as held in the Safeguard record set. The VulDB entry VDB-255392 and the linked write up were referenced by the record but could not be retrieved.
Last reviewed: 19 October 2026.
