CVE-2026-14745 in Real State Services
Summary
by MITRE • 07/05/2026
A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/08/2026
The vulnerability identified in code-projects Real State Services 1.0 represents a critical security flaw that exposes the application to remote sql injection attacks through improper input validation. This weakness specifically targets an unknown function within the /single-list_rent.php file, where user-supplied ID parameters are processed without adequate sanitization or parameterization mechanisms. The vulnerability falls under the category of CWE-89 sql injection as described in the Common Weakness Enumeration catalog, which classifies it as a direct consequence of insufficient input validation and improper database query construction.
The technical implementation of this vulnerability allows attackers to manipulate the ID argument passed to the targeted php script, enabling them to inject malicious sql payloads directly into the database query execution flow. When the application processes user input without proper validation or parameterization, it creates an environment where attacker-controlled data can alter the intended structure of sql commands. This vulnerability is particularly dangerous because it operates at the database interaction layer, potentially allowing unauthorized access to sensitive information, data modification, or complete database compromise.
The operational impact of this vulnerability extends beyond simple data exposure as it enables remote exploitation without requiring local system access or authentication credentials. Attackers can leverage publicly available exploits to target the application's web interface and execute malicious sql commands against the underlying database. This type of attack vector aligns with ATT&CK technique T1190 for exploiting weaknesses in web applications, specifically targeting the execution of arbitrary code through database injection methods. The remote nature of the exploit means that any user with access to the vulnerable application can potentially initiate attacks, making it particularly dangerous for production environments.
The security implications of this vulnerability include potential data breaches, unauthorized modification or deletion of property listings, customer information exposure, and possible escalation to broader system compromise. Organizations running this version of Real State Services should immediately implement mitigations such as input validation, parameterized queries, and web application firewalls to prevent exploitation attempts. Additionally, the vulnerability demonstrates the importance of proper code review practices and adherence to secure coding guidelines that address sql injection prevention techniques outlined in industry standards including OWASP Top Ten and NIST cybersecurity frameworks for web application security.