EUVD-2025-17041Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /Admin/InsertCity.php. The manipulation of the argument cmbState leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in code-projects Real Estate Property Management System 1.0, specifically in the /Admin/InsertCity.php file's cmbState parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
Technical ContextAI
This vulnerability stems from improper input validation and parameterization in PHP code handling database queries (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected file /Admin/InsertCity.php processes the cmbState parameter without proper SQL escaping or prepared statements, allowing SQL metacharacters to be injected directly into database queries. The Real Estate Property Management System is a web-based application that likely uses PHP with a backend database (MySQL/MariaDB), and the vulnerable endpoint is accessible to unauthenticated users based on the CVSS vector indicating no privilege requirements (PR:N).
RemediationAI
Immediate remediation steps: (1) Update to a patched version if available from code-projects; (2) Apply input validation: implement whitelist validation for cmbState parameter to accept only valid state identifiers; (3) Use prepared statements/parameterized queries for all database interactions in InsertCity.php; (4) Implement output encoding for database queries; (5) Apply principle of least privilege to database credentials used by the application. Workarounds if patch unavailable: (a) Disable or restrict access to /Admin/InsertCity.php at the web server level (nginx/Apache); (b) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the cmbState parameter; (c) Apply strict input validation regex patterns before query execution. Recommended: Contact code-projects for security updates or migrate to maintained alternatives.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today