CodeAstro Real Estate Management System CVE-2025-14900

Exploitation requires administrative authentication to the CodeAstro Real Estate Management System. The attacker must have valid administrator account credentials and network access to the /admin/userdelete.php endpoint. The application must be deployed with default or unpatched configuration. No special system-level privileges or non-default settings are required beyond the high-privilege administrator role. The SQL injection is directly exploitable in the ID parameter without requiring user interaction beyond the attacker's own authenticated requests.

This vulnerability presents a significant discrepancy between CVSS scoring and real-world exploitation probability. CVSS 4.0 (score 2.0) correctly identifies low impact due to PR:H (High Privilege requirement) and restricted scope/impact (VC:L, VI:L, VA:L with SC:N, SI:N, SA:N), meaning only confidentiality, integrity, and availability of the vulnerable component are affected, not the broader system. However, EPSS (0.01%, percentile 3%) indicates this is among the lowest-exploited vulnerabilities in the dataset, suggesting active exploitation is extremely unlikely despite public POC availability. The attack vector is Network (AV:N) with Low Complexity (AC:L), but the High Privilege requirement (PR:H) is the limiting factor-attackers must already be administrators, meaning this is primarily a post-compromise lateral-movement or privilege-abuse vector rather than a widespread threat. The presence of publicly available exploit code (E:P in CVSS) does not correlate with actual exploitation due to the authentication barrier. Security teams should prioritize patching systems where administrator accounts may be compromised, but this does not warrant emergency response measures for systems with strong administrator access controls.

An attacker who has gained administrator credentials through phishing or credential stuffing logs into the application and navigates to /admin/userdelete.php with a crafted ID parameter containing SQL injection syntax (e.g., ID=1 UNION SELECT username, password FROM users). The unvalidated input is concatenated into a SQL query, allowing the attacker to extract sensitive data from the database such as usernames, password hashes, or email addresses. Public exploit code (available on GitHub per references) provides ready-made payloads to demonstrate this attack.