Real Estate Property Listing App CVE-2025-14530

Exploitation requires an authenticated user account with administrator privileges (PR:H per CVSS vector PR field). The attacker must have valid login credentials or compromise an admin account to access the /admin/property.php endpoint. No special application configuration is required beyond default deployment. The vulnerability is NOT exploitable by unauthenticated remote users - anonymous attackers cannot reach the upload functionality. Exploitation is further limited to scenarios where the web server executes uploaded files (i.e., uploaded PHP files in a web-accessible directory with PHP execution enabled), which is typical in standard PHP deployments but may not apply if strict upload-directory execution policies are in place.

This vulnerability presents LOW real-world risk despite network accessibility. Multiple signals support this assessment: (1) CVSS vector shows PR:H (high privilege required), meaning only administrators or high-privilege users can exploit it - not unauthenticated attackers; (2) EPSS score of 0.07% (21st percentile) indicates very low exploitation probability in the wild, suggesting this is not actively targeted; (3) no CISA KEV confirmation of active exploitation; (4) the product is a niche application (SourceCodester Real Estate app) with likely limited deployment compared to mainstream CMS platforms. While the vulnerability itself is severity-significant (unrestricted upload), the authentication barrier and low EPSS divergence from CVSS (which would normally suggest 8.4 impact with network vector) indicates either patching by users or extremely limited attacker interest. Organizations running this application should prioritize patching, but this is not a critical incident risk compared to unauthenticated remote code execution flaws.

An authenticated administrator with legitimate access to the application logs into the admin panel and navigates to the property upload feature. Instead of uploading a legitimate image, the attacker (either a malicious insider or an account with compromised credentials) submits a PHP web shell in the image parameter field, labeled with an image extension (e.g., shell.php.jpg or a double-extension bypass). The application stores this file in a web-accessible directory without validation. The attacker then directly accesses the uploaded file via HTTP, triggering PHP execution and gaining remote command execution on the server.