Real State Services CVE-2026-14743

No special conditions - remote unauthenticated exploitation against default configurations of Real State Services 1.0. The only prerequisite is that the /normalHomeSale.php endpoint is network-accessible. No authentication, session token, or elevated privilege is required. Exploitation is limited in scope to the application's connected database; the CVSS 4.0 subsequent-system impact metrics (SC:N/SI:N/SA:N) confirm no lateral scope change to other systems is expected. The application must be actively deployed and reachable over HTTP/HTTPS; offline or localhost-only deployments are not exploitable remotely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) confirms unauthenticated, low-complexity remote exploitation with no special attack requirements, yielding a score of 6.9 (Medium). Impact is rated Low across all three pillars, suggesting the scope is limited to the application's own database rather than full system compromise. A public exploit lowers the barrier to exploitation, but the absence of a CISA KEV listing indicates no confirmed widespread in-the-wild abuse at time of analysis. EPSS data was not provided in source intelligence, so probabilistic exploitation rates cannot be quantified. The primary real-world risk dampener is product footprint: code-projects.org distributes demo and learning projects with minimal production adoption, meaning the exposed population is likely small. The combination of public POC plus zero patch makes any active deployment a genuine priority for the owners, but does not constitute broad enterprise risk.

An unauthenticated remote attacker identifies an internet-facing instance of Real State Services by scanning for the /normalHomeSale.php path. The attacker submits a crafted HTTP request appending a SQL payload such as ' OR 1=1-- to the loc parameter, causing the backend database query to return all records or reveal schema details. A public proof-of-concept exploit hosted on GitHub provides a ready-made template, requiring minimal adaptation to extract credentials, user data, or other sensitive database contents.