What is the CVSS score of CVE-2025-5583?

CVE-2025-5583 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5583?

A publicly disclosed SQL injection vulnerability in CodeAstro Real Estate Management System 1.0 allows remote attackers to compromise database integrity and extract sensitive data.

Is there a public PoC exploit available for CVE-2025-5583?

Yes, a public proof-of-concept exploit is available for CVE-2025-5583. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5583?

Within 24 hours: Identify all systems running CodeAstro 1.0 and isolate them from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy WAF rules to block SQL injection patterns targeting /register.php; implement input validation and parameterized queries via custom code patches if feasible. Within 30 days: Evaluate alternative real estate management solutions; plan migration timeline; conduct forensic review for signs of exploitation.

PHP CVE-2025-5583

EUVD-2025-16864 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Real Estate Management System RCE

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16864

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 04, 2025 - 17:44 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 10:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /register.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in CodeAstro Real Estate Management System version 1.0, specifically in the /register.php file that allows unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability enables attackers to read, modify, or delete sensitive database information including user credentials, property listings, and financial records. Public exploit code is available and the vulnerability is likely being actively exploited in the wild, making immediate patching essential for all affected installations.

Technical ContextAI

The vulnerability exists in the user registration endpoint (/register.php) of CodeAstro Real Estate Management System 1.0, which fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. This is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating inadequate input validation and output encoding. The root cause is the absence of prepared statements or parameterized queries, allowing attackers to break out of intended SQL syntax context and execute arbitrary database commands. The affected component processes registration data (likely email, username, password fields) without proper escaping, creating a direct SQL injection vector accessible over the network without authentication.

RemediationAI

Immediate actions: (1) Disable or restrict access to /register.php if registration is not actively required; (2) Implement Web Application Firewall (WAF) rules to block common SQL injection payloads in registration parameters; (3) Apply input validation requiring email format validation, alphanumeric username restrictions, and length limits on all fields. (4) Upgrade to the latest patched version of CodeAstro Real Estate Management System (version number not specified in available data—contact CodeAstro directly); (5) If patching is not immediately available, implement parameterized queries or prepared statements in the registration code by modifying /register.php to use proper database abstraction layers; (6) Run database activity monitoring to detect injection attempts; (7) Audit database logs for suspicious queries and review user accounts created during the vulnerability window for unauthorized access. Vendors should provide specific patch versions and security advisories; recommend checking CodeAstro security advisories and changelog documentation.