Real Estate Management System CVE-2026-78244

No authentication or account is required - the search.php endpoint is publicly accessible. No special configuration or non-default feature flag needs to be enabled; the vulnerability is present in the default installation of version 1.0. Exploitation is limited to deployments that are reachable over a network (Internet or LAN); installations not exposed to untrusted networks are not at risk from external attackers. The impact is further bounded by the privilege level of the application's database user: if the DB account has only SELECT permissions, write-based attacks (INSERT/UPDATE/DELETE) are blocked at the database layer, though data exfiltration remains possible. The application must be running PHP with an active database backend.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no special attack conditions required, which is the most dangerous attack surface profile. However, impact is capped at Low across all three dimensions (VC:L/VI:L/VA:L), reflecting that the vulnerable system's database access is constrained - consistent with a typical application-layer DB user rather than a DBA account. The E:P supplemental metric confirms a public PoC exists, raising the realistic exploitation probability above what raw CVSS alone would suggest. No EPSS value was provided in the input data, so exploitation probability cannot be quantified against the broader CVE population. KEV status is absent, indicating no confirmed widespread active exploitation at time of analysis. The product is a free PHP script from itsourcecode, deployed primarily by students or small hobbyist operators rather than enterprise environments, which substantially limits the real-world blast radius. Overall: the combination of unauthenticated remote access and a public PoC makes this a credible, low-effort attack for any Internet-exposed deployment, but the limited prevalence and low impact ceiling mean this does not rise to the urgency of a high-prevalence SQLi.

An unauthenticated attacker submits a crafted HTTP GET or POST request to the publicly accessible search.php endpoint, injecting SQL syntax into one of the four vulnerable parameters (e.g., search_price=' OR '1'='1). The injected query executes against the backend database, allowing the attacker to enumerate table contents, extract user credentials, or modify property listing records. Because a public PoC is available on GitHub, this requires minimal attacker skill.