Executive brief
Code-projects Real State Services, a web application for managing real estate listings, contains a security flaw in its login component. An attacker can exploit this to bypass authentication, access the underlying database, and potentially steal or modify sensitive information. This vulnerability can be exploited remotely without any prior account or special access.
Technical details
A SQL injection vulnerability exists in the login component of code-projects Real State Services 1.0. The 'Username' parameter in the 'loginuser.php' file is not properly sanitized or validated before being used in a database query. A remote, unauthenticated attacker can provide specially crafted input (such as time-based blind SQL payloads) to manipulate SQL queries. This can lead to unauthorized database access, data exfiltration, or modification of records. The vulnerability has been confirmed via public proof-of-concept using time-based blind injection techniques.
Affected products
- code-projects Real State Services 1.0
Timeline
- 2026-05-10: disclosed: Initial disclosure on GitHub issues
- 2026-06-01: advisory: NVD publication date