Executive brief
Real State Services is a web application used for managing property listings. A security flaw in the property submission component allows an attacker to interfere with the application's database. This could lead to the unauthorized viewing of sensitive information, modification of property data, or disruption of the service.
Technical details
A SQL injection vulnerability exists in code-projects Real State Services 1.0 within the 'addprojectrent.php' file. The root cause is the improper neutralization of the 'amen' parameter before it is used in a SQL query. A remote, unauthenticated attacker can exploit this by sending a specially crafted POST request containing SQL commands. Successful exploitation allows for error-based or time-based blind SQL injection, enabling the attacker to extract database information, modify records, or potentially gain further control over the underlying system. Public exploits (PoCs) using sqlmap have been disclosed.
Affected products
- code-projects Real State Services 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability details and PoC shared on GitHub issue tracker
- 2026-07-05: advisory: CVE published and NVD record created