Is there a public PoC exploit available for CVE-2025-14897?

Yes, a public proof-of-concept exploit is available for CVE-2025-14897. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Real Estate Management System CVE-2025-14897

Q: What is the CVSS score of CVE-2025-14897?

CVE-2025-14897 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-19 cna@vuldb.com

PHP SQLi Real Estate Management System

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:48 vuln.today

DescriptionCVE.org

A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.php of the component Administrator Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the /admin/useragentdelete.php endpoint. The vulnerability requires administrator credentials but poses risk to systems where admin accounts may be compromised or where privileged users are untrusted. Publicly available exploit code exists, though EPSS indicates low real-world exploitation probability at 0.05%.

Technical ContextAI

The vulnerability is a SQL injection (CWE-74) in the PHP-based administrator endpoint /admin/useragentdelete.php. SQL injection occurs when user-supplied input is concatenated directly into SQL queries without proper parameterization or escaping, allowing attackers to break out of the intended query context and inject arbitrary SQL commands. The affected product is CodeAstro Real Estate Management System version 1.0 (CPE: cpe:2.3:a:codeastro:real_estate_management_system:1.0). The attack vector is network-based, meaning the endpoint is remotely accessible, but exploitation is restricted to users with administrator privileges (PR:H in CVSS v4.0).

RemediationAI

Upgrade CodeAstro Real Estate Management System to a patched version if available from the vendor at codeastro.com. If a patched version is unavailable, apply parameterized queries (prepared statements) to the /admin/useragentdelete.php endpoint to prevent SQL injection, ensuring all user inputs are bound as data rather than SQL syntax. Additionally, restrict administrative access to trusted personnel only, implement strong authentication for administrator accounts (e.g., multi-factor authentication), and conduct regular access audits. Monitor database query logs for suspicious SQL commands originating from the admin endpoint. If immediate patching is not feasible, consider disabling the useragentdelete functionality entirely if operationally acceptable, or place the /admin/ path behind additional network-level access controls (VPN, IP allowlisting) to reduce exposure to remote attackers.