Real Estate Management System CVE-2025-5580

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS 7.3 (High) with network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N) indicates the attack is trivially executable by any unauthenticated remote attacker; (2) Public proof-of-concept availability dramatically increases exploitation probability and likelihood of automated attacks; (3) The login.php location means attackers can bypass authentication entirely, achieving administrative access or credential enumeration; (4) CVSS impact metrics show confidentiality, integrity, and availability all compromised (C:L/I:L/A:L), though limited to 'Low' scope suggests potential for escalation; (5) Active public disclosure transforms this from theoretical to weaponized threat. Using SSVC framework: Exploitation=Active (POC public), Automatable=Yes (SQL injection trivially scriptable), Technical Impact=High (authentication bypass), leading to immediate remediation requirement. This is NOT a false positive—despite 'classified as critical' being contradicted by CVSS 7.3 (which is 'High'), the actual exploitation risk justifies urgent patching due to authentication mechanism compromise.

An attacker navigates to the CodeAstro login page and enters the following in the email field: admin'-- or 1=1-- . The application concatenates this into a query like SELECT * FROM users WHERE email='admin'-- or 1=1--' AND password='anything' . The -- comments out the password check, allowing login as the first user (typically admin). Alternatively, attacker uses UNION-based injection: ' UNION SELECT username, password FROM users-- to extract all credentials in a single request. Since AC:L and PR:N, no user interaction required—attacker automates requests via script or publicly available SQL injection tools. With authentication bypassed, attacker gains access to tenant data, property listings, financial records, and can modify/delete content. The public POC means script-kiddies and automated vulnerability scanners will begin targeting instances within hours of disclosure.