CodeAstro Real Estate Management System CVE-2025-14897

Exploitation requires authentication as an administrator user with access to the /admin/ endpoint. The vulnerability does not affect unauthenticated remote attackers. The vulnerable parameter in /admin/useragentdelete.php must accept unsanitized input that is directly used in an SQL query. No special application configuration is mentioned as required; the vulnerability exists in the default code. Limitation: exploitation is restricted to users or attackers who possess valid administrator credentials, which significantly reduces real-world exposure compared to network-accessible unauthenticated vulnerabilities.

This vulnerability presents a low real-world risk despite having a publicly available exploit, based on multiple converging signals. CVSS v4.0 vector shows PR:H (high privilege requirement), meaning only administrators can exploit it-significantly limiting the attack surface. EPSS at 0.05% percentile indicates very low exploitation probability in practice, placing this in the bottom 14% of vulnerabilities by exploitation likelihood. The contradiction between POC availability and low EPSS suggests the exploit is theoretical or requires specific deployment conditions rarely met in practice. CVSS Impact ratings are all Low (VC:L, VI:L, VA:L), indicating limited damage scope even upon successful exploitation. The primary risk applies to organizations where administrator accounts are compromised, shared, or held by untrusted personnel-a scenario less common than network-wide threats. Organizations with strong access controls and low admin credential compromise rates should deprioritize this below network-accessible vulnerabilities lacking privilege requirements.

An administrator with legitimate access to the CodeAstro Real Estate Management System application sends a crafted HTTP request to /admin/useragentdelete.php containing SQL injection payload in an unvalidated parameter. The injected SQL command executes within the database context, allowing the attacker to extract sensitive data, modify records, or potentially escalate impact depending on database permissions. Alternatively, if an administrator account is compromised (via phishing, credential stuffing, or lateral movement), an attacker could leverage this endpoint to manipulate the database.