CodeAstro Real Estate Management System CVE-2025-14899

Exploitation requires the attacker to possess valid administrator credentials and network access to the CodeAstro REMS administrative interface. The /admin/stateadd.php endpoint must be directly accessible without additional authentication beyond the initial admin login. No special configuration is mentioned in the CVE description; the vulnerability is present in the default state installation of version 1.0. The attack is limited to users with the administrator role (PR:H), which significantly restricts the attack surface compared to unauthenticated network vulnerabilities. If the admin console is restricted to internal networks or behind a VPN, exploitation further requires initial compromise of an internal system or theft of valid admin credentials.

The CVSS v4.0 score of 2.0 reflects very low risk due to several mitigating factors: the attack requires high-privilege credentials (PR:H), the impact is limited to confidentiality and integrity with low severity (VC:L/VI:L), and the scope is confined (S:X not set to changed). The EPSS score of 0.05% (14th percentile) further indicates low likelihood of widespread exploitation despite publicly available POC code, suggesting this is not a high-priority target for mass exploitation. However, this is a classic insider threat vector: a malicious administrator could leverage SQL injection to exfiltrate sensitive real estate transaction data or modify property records. The disconnect between 'publicly available exploit' and very low EPSS/CVSS suggests the barrier to initial access (requiring admin account) is the primary limiting factor in real-world exploitation. Organizations should assess whether CodeAstro REMS 1.0 is deployed in their environment and whether admin account compromise is a realistic threat model; if not, this ranks lower than network-accessible vulnerabilities.

A disgruntled employee with administrative credentials to the CodeAstro REMS system visits the /admin/stateadd.php endpoint via their web browser or via an automated tool. Instead of submitting a legitimate state name, they inject a SQL UNION query in the input field, e.g., stateadd.php?name=state' UNION SELECT password FROM admin_users--, exfiltrating administrator password hashes. Alternatively, they execute a DELETE statement to purge critical real estate listing data. The publicly available POC from GitHub demonstrates the exact payload syntax, enabling rapid exploitation.