Is there a public PoC exploit available for CVE-2025-14900?

Yes, a public proof-of-concept exploit is available for CVE-2025-14900. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Real Estate Management System CVE-2025-14900

Q: What is the CVSS score of CVE-2025-14900?

CVE-2025-14900 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-19 cna@vuldb.com

PHP SQLi Real Estate Management System

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:48 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the ID parameter in /admin/userdelete.php. The vulnerability requires administrator access and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. Publicly available exploit code exists, though EPSS scoring (0.01%, percentile 3%) indicates minimal real-world exploitation probability, suggesting the threat is primarily theoretical despite public disclosure.

Technical ContextAI

The vulnerability exists in the Administrator Endpoint at /admin/userdelete.php, which fails to properly sanitize or parameterize SQL queries constructed from user-supplied input in the ID parameter. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection') flaw in PHP. The affected product is CodeAstro Real Estate Management System version 1.0 (CPE: cpe:2.3:a:codeastro:real_estate_management_system:1.0:*:*:*:*:*:*:*). The SQL injection occurs when the ID argument is processed without input validation or prepared statements, allowing attackers with administrator credentials to manipulate queries.

RemediationAI

Upgrade CodeAstro Real Estate Management System to a patched version if available from the vendor; consult https://codeastro.com/ for security updates. Immediate workarounds include implementing input validation and parameterized SQL queries (prepared statements) in /admin/userdelete.php to sanitize the ID parameter before use in SQL operations. Restrict administrative access to the /admin/ directory to trusted users and IP ranges using web server configuration (e.g., .htaccess, nginx directives, or firewall rules), reducing the attack surface to post-compromise scenarios. Monitor administrator account activity and SQL query logs for suspicious patterns. If no vendor patch is available, implement Web Application Firewall (WAF) rules to block SQL injection payloads (e.g., UNION, SELECT, OR 1=1) in the ID parameter; note that WAF-level mitigation may produce false positives and requires careful tuning.