Which versions of PHP are affected by EUVD-2025-17039?

A publicly disclosed SQL injection vulnerability in the Real Estate Property Management System (version 1.0) allows remote attackers to compromise database integrity and access sensitive property and…

Is there a public PoC exploit available for EUVD-2025-17039?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17039. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-17039?

Within 24 hours: Identify all deployed instances of Real Estate Property Management System 1.0, isolate affected systems from production networks if possible, and restrict access to /Admin/NewsReport.php to authorized personnel only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection attempts targeting the txtFrom parameter, implement database query logging, and conduct forensic review for signs of exploitation. Within 30 days: Upgrade to a patched version when released by the vendor, or migrate to an alternative supported property management solution; perform full security assessment of all administrative interfaces.

PHP EUVD-2025-17039

Q: What is the CVSS score of EUVD-2025-17039?

EUVD-2025-17039 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-5708 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-06 cna@vuldb.com

PHP SQLi Real Estate Property Management System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17039

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 06, 2025 - 01:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /Admin/NewsReport.php. The manipulation of the argument txtFrom leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/NewsReport.php file where the 'txtFrom' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), a broad category encompassing SQL injection flaws. The Real Estate Property Management System (CPE: likely cpe:2.3:a:code-projects:real_estate_property_management_system:1.0:*:*:*:*:*:*:*) contains unvalidated user input in the txtFrom parameter passed to /Admin/NewsReport.php. The application fails to properly escape, parameterize, or validate SQL query inputs before executing database operations. This is a classic SQL injection vulnerability where attackers craft malicious SQL payloads within the txtFrom field to break out of intended query context and execute unauthorized database commands.

RemediationAI

Immediate Actions: (1) PATCH: Upgrade to a patched version if available from code-projects (version information not provided in sources—contact vendor directly for patch release); (2) INPUT VALIDATION: Implement strict whitelist validation for the txtFrom parameter—validate expected format, length, and character set before use; (3) PARAMETERIZED QUERIES: Refactor /Admin/NewsReport.php to use parameterized/prepared statements for all SQL queries, eliminating SQL injection risk; (4) TEMPORARY MITIGATION: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in txtFrom parameter (e.g., detect 'OR', 'UNION', comment sequences); (5) ACCESS CONTROL: Restrict /Admin/ directory to known IP ranges and require additional authentication if possible; (6) MONITORING: Enable SQL query logging and audit logs to detect exploitation attempts. Contact code-projects support for official patch information and timeline.