Executive brief
A vulnerability exists in Real State Services, a web application used for managing real estate listings. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of site content. This attack can be carried out remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in code-projects Real State Services 1.0 within the 'normalHomeSale.php' component. The root cause is the improper neutralization of special elements in the 'loc' POST parameter, which is used directly in SQL queries without adequate validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to manipulate database queries. Successful exploitation can lead to unauthorized data retrieval (via UNION-based or error-based techniques), data modification, or time-based blind inference of database contents. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Real State Services 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability details and PoC shared on GitHub by researcher 6Justdododo6
- 2026-07-05: advisory: CVE-2026-14743 published to the NVD dataset