Real State Services CVE-2026-14745

The /single-list_rent.php endpoint must be reachable over the network - the CVSS 4.0 vector AV:N/PR:N/UI:N confirms no authentication and no user interaction are required against a standard installation. The application must be running with a connected backend database (standard for this application class). No special configuration, non-default feature flag, or privileged account is required; a default installation is sufficient. Exploitation is limited by: the application must be internet-facing or otherwise reachable by the attacker (internal-only deployments are substantially protected); only version 1.0 is explicitly confirmed vulnerable, though the CPE wildcard suggests other versions may be affected; and the backend database user account's privileges determine the ceiling of data access - a least-privilege DB account limits, but does not prevent, SQL injection impact.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) reflects low-complexity, unauthenticated, network-reachable exploitation with low individual impact ratings across confidentiality, integrity, and availability. The low impact tiers likely reflect the application's limited scope rather than a constrained exploit capability - successful SQL injection against this class of PHP application routinely yields full database read access, credential extraction, and record manipulation, which arguably warrants higher C/I ratings in practice. No EPSS score was provided, so statistical exploitation probability cannot be quantified. The product is not listed in CISA KEV, so mass exploitation is not confirmed. However, the E:P tag and the GitHub POC confirm exploit code is publicly accessible, making opportunistic scanning feasible for low-skill attackers. Overall: elevated realistic risk for any internet-exposed deployment, but substantially constrained by the product's niche footprint.

An unauthenticated attacker sends an HTTP request to a publicly accessible Real State Services 1.0 instance with a crafted id parameter value - for example, GET /single-list_rent.php?id=1'+OR+'1'='1 - causing the unsanitized input to alter the SQL query logic and return unauthorized data. Using UNION-based or blind SQL injection techniques (documented in the publicly available GitHub POC), the attacker enumerates database tables and extracts stored records including user credentials, contact information, or property data. Low skill is required given the public POC, and the absence of authentication prerequisites means no account compromise is needed as a precondition.