Real Estate Property Management System CVE-2025-5704

The CVSS 3.1 score of 7.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates high severity: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and impact across confidentiality, integrity, and availability. The publicly disclosed exploit (confirmed in description) and lack of authentication requirement dramatically elevate real-world risk. While CWE-74 is classified as critical, the CVSS score of 7.3 (rather than 9.0+) reflects the 'L' (Low) impact ratings for each security triad component—the attacker gains moderate but not complete system compromise. However, combined with public POC availability and remote unauthenticated attack vector, this presents immediate exploitability. SSVC considerations: exploitation is active/confirmed (public POC), automatable (SQL injection tooling), and causes integrity/confidentiality breaches. This is a critical priority despite sub-critical CVSS due to ease of exploitation and public availability.

An attacker discovers the Real Estate Property Management System 1.0 deployed at a target organization's admin panel (commonly /admin). They access /Admin/User.php directly via browser and inject SQL payload into the txtUserName parameter, e.g., txtUserName=admin' OR '1'='1' -- or a UNION-based injection to extract user credentials from the database. Since PR:N (no privileges required) and UI:N (no user interaction), the attacker can automate this via curl, burp, or sqlmap without authentication. The injected SQL executes with the application's database credentials, allowing data exfiltration (user accounts, property records, financial data), authentication bypass, or database destruction. Public POC tools reduce barrier to entry; script-kiddie-level exploitation is probable.