CVE-2026-14745: SQL Injection in Real State Services 1.0 – Remote Code Execution Risk

Technical summary

CVE-2026-14745 is a SQL injection flaw (CWE-89) stemming from improper neutralization of special elements (CWE-74) in the ID parameter of /single-list_rent.php. The vulnerability lacks authentication controls (PR:N) and has low attack complexity (AC:L), meaning an attacker can craft malicious SQL payloads and submit them via the network to execute arbitrary database queries. The CVSS 3.1 score of 7.3 (HIGH) reflects low confidentiality, integrity, and availability impact within the scope of a single user context, though in real estate applications handling customer data, the practical impact could be significant.

Business impact

Real Estate Services deployments using version 1.0 face risk of unauthorized access to property listings, customer information, and potentially financial or transaction records stored in the backend database. Attackers could extract sensitive data, modify listings, or corrupt records. The public availability of exploit code elevates the likelihood of opportunistic attacks. Organizations hosting this software should assume elevated exposure given the ease of remote exploitation and lack of authentication requirements.

Affected systems

code-projects Real State Services 1.0 is the confirmed affected product. Any deployment or installation of this specific version running /single-list_rent.php is vulnerable. Verify your installed version against vendor advisories and check whether you are running version 1.0 or a patched release.

Exploitability

Exploitability is high. The attack vector is network-based with no authentication required, no user interaction needed, and low complexity—an attacker can exploit this with a simple HTTP request containing a malicious ID parameter. Public exploit availability further lowers the barrier to exploitation, making this a practical attack vector for both targeted and indiscriminate attacks against exposed instances.

Remediation

Immediate action is required: upgrade code-projects Real State Services to a patched version released after this vulnerability disclosure. Verify the patch version against the vendor advisory. As an interim measure, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter, restrict network access to the affected application, and monitor database logs for suspicious query patterns.

Patch guidance

Contact code-projects for the official patch or security update for Real State Services. The vendor should provide a version number addressing this SQL injection. Verify the patch version in the official advisory before deployment. Test the patch in a non-production environment first, then deploy across all instances running version 1.0. Document your patching completion and version numbers for compliance records.

Detection guidance

Monitor web server logs and WAF logs for requests to /single-list_rent.php containing SQL syntax characters (single quotes, double dashes, UNION, SELECT, etc.) in the ID parameter. Monitor database logs for unusual query patterns, failed authentication attempts, or unexpected data access. Use intrusion detection signatures for SQL injection attacks. Implement query-level logging to capture potentially malicious SQL statements before execution.

Why prioritize this

This vulnerability warrants immediate prioritization due to: (1) HIGH CVSS score (7.3) with multiple impact vectors; (2) remote unauthenticated exploitation with low attack complexity; (3) public exploit availability creating immediate attack risk; (4) sensitivity of real estate and customer data typically handled by such systems; and (5) likelihood that opportunistic scanning and exploitation are already underway. Patch or implement compensating controls within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-accessible SQL injection with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). The 'S:U' (scope unchanged) and 'C:L/I:L/A:L' (low impact across confidentiality, integrity, and availability) yield a HIGH severity rating. However, in the context of a real estate application storing PII and transaction data, the practical risk is elevated—SQL injection often permits complete database compromise, meaning the assigned impact metrics may understate actual organizational risk.

Frequently asked questions