Summary
Obed Nyakundi Rental House Management System 1.0 contains an authentication bypass vulnerability in /admin/functions/new_admin.php. The application processes user creation requests without validating administrative sessions or credentials. This allows a remote attacker to gain full administrative access by creating a new account. A CVE identifier has been reserved with MITRE and is pending a public reference record.
Impact
A remote, unauthenticated attacker can create a new administrative account and obtain full administrative privileges over the application, enabling privilege escalation and complete control of the management interface and its data.
Remediation
Require a validated administrative session before processing any request that creates or modifies administrator accounts. Reject unauthenticated and non-administrative callers at the access-control layer, and review related administrative endpoints for the same missing authentication check. Until a vendor fix is available, restrict public network exposure of the application and place administrative paths behind additional access controls.