CodeAstro Real Estate Management System CVE-2025-14898

High-privilege administrator authentication is required-exploitation is not possible by anonymous or low-privilege users. The attacker must possess valid administrative credentials and network access to the /admin/ endpoint, which is typically restricted to trusted internal networks or behind authentication layers. The exploit requires the administrator to actively send a crafted request with SQL injection payload to /admin/userbuilderdelete.php, meaning no automatic exploitation (AC:L but PR:H limits scope). The endpoint must be accessible and the application must not use parameterized queries or prepared statements for the affected SQL command. Non-default deployment configurations (e.g., firewall restrictions, endpoint-level access controls, or Web Application Firewall rules) may block exploitation. The limiting factor is the PR:H (high-privilege) requirement, which restricts the attacker pool to administrators or account-compromise scenarios.

This vulnerability presents LOW real-world risk despite public exploit availability. Multiple signals confirm this assessment: CVSS score of 2.0 is very low, EPSS exploitation probability is 0.05% (14th percentile), indicating minimal likelihood of automated or widespread exploitation. The CVSS vector PR:H (high privilege required) is the primary limiting factor-exploitation requires an authenticated administrator account, meaning only trusted insiders or attackers who have compromised valid admin credentials can exploit this. The impact scope is constrained to confidentiality and integrity (VC:L, VI:L) with low impact in each, ruling out critical data theft or system compromise. The presence of public exploit code (marked E:P) elevates the theoretical risk for malicious insiders but does not change the practical risk for organizations with strong access controls. CVSS vector and EPSS score align (both indicate low priority), confirming this is not a misrated vulnerability. The primary concern is not mass remote exploitation but rather insider threat mitigation in environments with poor administrator segregation or weak credential hygiene.

An administrator with legitimate access to the CodeAstro Real Estate Management System receives a phishing email or is socially engineered into visiting a malicious website that triggers an automated HTTP request to /admin/userbuilderdelete.php with injected SQL syntax in the request parameters. Alternatively, a disgruntled system administrator with valid credentials intentionally crafts a malicious request to the endpoint to extract sensitive data from the backend database or modify application data. The publicly available POC (https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli-userbuilderdelete.php.md) provides the exact injection payload, reducing barrier to exploitation for any individual with admin access.