Real Estate Management System EUVD-2025-16860

CVSS 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates a network-accessible, low-complexity vulnerability requiring no privileges or user interaction, affecting confidentiality, integrity, and availability with unchanged scope. The CVSS score alone places this in the 'high' severity band. Combined with public PoC disclosure and unauthenticated attack vector (AV:N/PR:N), real-world risk is substantial. Without EPSS data or KEV status explicitly provided, threat modeling based on the public disclosure status suggests this is likely to be actively exploited or under active reconnaissance by threat actors. The 'critical' severity declaration in the description, combined with direct database access potential through SQL injection, elevates actual exploitability beyond the CVSS 7.3 score. Organizations running CodeAstro 1.0 should treat this as an immediate priority.

An unauthenticated attacker performs reconnaissance on a target organization running CodeAstro Real Estate Management System 1.0. The attacker identifies the /admin/index.php endpoint and discovers the 'User' parameter is vulnerable to SQL injection. The attacker crafts a malicious input such as: User=admin' OR '1'='1' or User=admin'; DROP TABLE users;-- to bypass authentication or exfiltrate database contents. Since the attack vector is network-based (AV:N) with low complexity (AC:L) and no authentication required (PR:N), exploitation is straightforward and can be automated. With public PoC availability, the attacker may leverage existing exploit code or frameworks (e.g., sqlmap) to automate enumeration and database compromise. Potential impacts include unauthorized administrative access, theft of property listings and customer PII, financial transaction manipulation, or complete system compromise.