Real Estate Management System CVE-2025-5583

This vulnerability presents HIGH real-world risk across multiple indicators: (1) CVSS 7.3 with Network attack vector and no authentication requirements indicates easy exploitability; (2) Low attack complexity (AC:L) means no special conditions needed; (3) CVSS impact scores of Low/Low/Low for confidentiality/integrity/availability significantly undervalue the risk—SQL injection in a registration system can compromise all user data and enable lateral movement; (4) Public disclosure of exploit code combined with ease of exploitation creates immediate active threat status; (5) The vulnerability is highly automatable as SQL injection payloads can be systematically tested against standard registration fields. SSVC perspective: exploitation is confirmed (public POC), the attack is automatable (SQLi tools work out-of-box), and technical impact is severe (database compromise). This should be treated as a critical priority despite the 7.3 CVSS score, as real-estate management systems handle PII, financial data, and property information with significant liability implications.

An attacker navigates to the CodeAstro Real Estate Management System registration page and enters a SQL injection payload in the email field: ' OR '1'='1' -- or uses UNION-based injection to extract the user credential table. Because /register.php fails to sanitize input before constructing SQL INSERT or SELECT queries, the payload is executed directly against the database. The attacker can: (1) enumerate table and column names, (2) extract user email addresses and password hashes, (3) insert administrative user accounts to gain system access, (4) modify property listings or pricing information, (5) exfiltrate customer PII and transaction data. No authentication is required—the attack succeeds on first connection. Given public POC availability and low attack complexity, automated scanning tools can identify vulnerable instances across the internet and launch attacks within seconds. Real estate agencies using CodeAstro 1.0 are at immediate risk of data breach, regulatory compliance violations (GDPR/CCPA), and operational disruption.