Real State Services 1.0 - CraftedSignal Threat Feed

CVE-2026-14769 — SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 21:24:19 +0000

A significant security vulnerability, CVE-2026-14769, has been identified in version 1.0 of the code-projects Real State Services application. This flaw specifically affects the /pay.php endpoint, where inadequate sanitization of the Bankname argument permits remote SQL Injection. The exploit for this vulnerability has been publicly disclosed and is actively available, increasing the risk of widespread exploitation. Successful attacks could lead to unauthorized access to the application's underlying database, potentially compromising sensitive information, corrupting data, or impacting the availability of the service. Defenders should prioritize patching and implement robust input validation to mitigate the threat posed by this easily exploitable vulnerability.

Attack Chain

An unauthenticated attacker sends a specially crafted HTTP POST or GET request to the /pay.php endpoint of the vulnerable code-projects Real State Services 1.0 application.
The request includes malicious SQL injection payloads embedded within the Bankname argument, designed to manipulate the application's database queries.
The application, lacking proper input validation and sanitization for the Bankname parameter, directly incorporates the attacker-supplied malicious string into its backend SQL query.
This improper handling results in a classic SQL Injection vulnerability, allowing the attacker to execute arbitrary SQL commands on the application's database.
Depending on the database permissions and attacker's objectives, this can lead to unauthorized information disclosure (e.g., retrieving sensitive user data, credentials, or system configurations).
The attacker may also be able to modify, insert, or delete data within the database, causing data integrity issues or service disruption.
In some configurations, successful SQL Injection can be escalated to arbitrary command execution on the underlying server, providing the attacker with full system control.
The ultimate objective could be data exfiltration, defacement, or further lateral movement within the compromised environment.

Impact

Successful exploitation of CVE-2026-14769 grants an attacker unauthorized control over the application's database. This directly translates to a high risk of sensitive data exposure, including user credentials, financial records, or other proprietary business information. Beyond confidentiality impact, attackers can tamper with database records, leading to data integrity issues that can disrupt business operations, degrade service quality, or facilitate further fraudulent activities. While the CVSS score indicates low impact on Confidentiality, Integrity, and Availability, the nature of SQL Injection, especially with publicly available exploits, often leads to severe consequences for affected organizations across various sectors.

Recommendation

Patch Immediately: Apply any available patches or updates from code-projects for Real State Services 1.0 to address CVE-2026-14769.
Deploy WAF: Implement or update Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting the /pay.php endpoint and the Bankname argument, leveraging the patterns defined in the Sigma rule below.
Input Validation: Review and enhance application-level input validation on all user-supplied data, especially the Bankname parameter within /pay.php, to prevent SQL injection.
Deploy Sigma Rules: Deploy the provided Sigma rule "Detects CVE-2026-14769 Exploitation — SQL Injection via /pay.php Bankname Argument" to your SIEM and tune for your environment, focusing on webserver logs.

CVE-2026-14768: Remote SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 20:23:33 +0000

A critical remote SQL injection vulnerability, tracked as CVE-2026-14768, has been discovered in version 1.0 of the code-projects Real State Services application. This flaw specifically affects the /builderHome.php file, where improper sanitization of the loc argument allows unauthenticated attackers to inject malicious SQL queries. This vulnerability can be exploited remotely, leading to unauthorized access to the underlying database, data exfiltration, data manipulation, or potentially further system compromise. The CVSS v3.1 Base Score is 7.3 (High), and a public exploit for this vulnerability is currently available, significantly increasing the risk of widespread exploitation by various threat actors. Organizations utilizing code-projects Real State Services 1.0 should consider immediate remediation due to the ease of exploitation and potential impact.

Attack Chain

An unauthenticated attacker crafts a malicious HTTP GET or POST request targeting the /builderHome.php endpoint of the vulnerable Real State Services application.
The attacker embeds SQL injection payloads within the loc argument of the HTTP request, designed to bypass input validation.
The vulnerable application processes the unsanitized loc argument directly within a backend SQL query.
The injected SQL commands are executed by the application's database, allowing the attacker to interact with the database beyond legitimate access.
This enables the attacker to perform actions such as retrieving sensitive information (e.g., user credentials, property listings), modifying database contents, or executing arbitrary commands on the host server if the database configuration permits (e.g., via xp_cmdshell or LOAD_FILE/INTO_OUTFILE).
The attacker achieves unauthorized access to the application's backend data or gains further control over the hosting server, leading to data compromise or system takeover.

Impact

Successful exploitation of CVE-2026-14768 grants attackers full control over the application's database. This can lead to severe consequences, including the exfiltration of sensitive real estate data, customer information, or administrative credentials. Data integrity could be compromised through unauthorized modification or deletion of records. Given the public availability of an exploit, organizations running code-projects Real State Services 1.0 face an immediate and elevated risk of data breaches, reputational damage, and potential regulatory fines. The impact on victims could range from unauthorized access to critical business information to complete compromise of the underlying server infrastructure.

Recommendation

Immediately apply any available patches or security updates for code-projects Real State Services 1.0 to address CVE-2026-14768.
Deploy the Detect CVE-2026-14768 Exploitation - Real State Services SQLi Sigma rule to your SIEM to detect attempted exploitation of this vulnerability.
Implement or strengthen Web Application Firewall (WAF) rules to detect and block common SQL injection patterns and anomalous requests targeting /builderHome.php.
Enable comprehensive web server logging and regularly review logs for suspicious HTTP requests containing SQL injection payloads, especially those targeting /builderHome.php with the loc argument.

CVE-2026-14747: SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 13:21:42 +0000

A critical SQL Injection vulnerability, tracked as CVE-2026-14747, has been identified in version 1.0 of the code-projects Real State Services application. This flaw resides within an unspecified function of the /addprojectsale.php file, where improper handling of user-supplied input to the amen argument allows for remote, unauthenticated attackers to inject and execute arbitrary SQL commands. This enables attackers to bypass security measures, extract sensitive information from the underlying database, or potentially achieve further system compromise depending on the database's privileges. The vulnerability was publicly disclosed on July 5, 2026, by VulDB and is a significant concern for organizations using this specific version of the Real State Services application, as exploitation can lead to severe data breaches.

Attack Chain

An unauthenticated attacker identifies a web-facing instance of code-projects Real State Services 1.0.
The attacker crafts a specially designed HTTP POST request targeting the /addprojectsale.php endpoint.
This request includes a malicious SQL injection payload within the amen parameter, bypassing input validation.
The vulnerable application processes the request, incorporating the unsanitized amen parameter value directly into a database query.
The backend SQL database executes the attacker-supplied malicious SQL commands, leading to unauthorized access.
Successful exploitation allows the attacker to read, modify, or delete database contents, extract sensitive data, or potentially establish persistence (e.g., by writing a web shell if sufficient database privileges exist).
The attacker then proceeds with data exfiltration or further compromise of the affected web server.

Impact

Successful exploitation of CVE-2026-14747 can lead to severe consequences for organizations utilizing code-projects Real State Services 1.0. Attackers can gain complete control over the application's database, leading to unauthorized disclosure of sensitive customer data, property listings, or internal operational information. This can result in significant financial losses, reputational damage, regulatory penalties, and potential service disruption. The remote and unauthenticated nature of the vulnerability means that any internet-exposed instance of the application is at risk, potentially affecting numerous small to medium-sized businesses in the real estate sector.

Recommendation

Immediately update code-projects Real State Services to a patched version once available to remediate CVE-2026-14747.
Deploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against CVE-2026-14747.
Review web server logs for suspicious activity targeting /addprojectsale.php with SQL injection patterns.
Implement a Web Application Firewall (WAF) in front of the application to filter and block malicious SQL injection payloads.

CVE-2026-14746: SQL Injection in code-projects Real State Services

hello@craftedsignal.io — Sun, 05 Jul 2026 12:21:44 +0000

A high-severity SQL injection vulnerability, identified as CVE-2026-14746, has been discovered in version 1.0 of the code-projects Real State Services application. This flaw specifically affects the /addprojectrent.php endpoint, where an attacker can manipulate the amen argument to inject and execute arbitrary SQL commands. The vulnerability is remotely exploitable and does not require authentication, making it a critical threat. Public disclosure of the exploit increases the likelihood of active exploitation in the wild. This vulnerability could lead to unauthorized access to sensitive data, modification of database contents, or potentially complete compromise of the affected web application's data. Organizations running this specific application version are strongly advised to take immediate remediation steps.

Attack Chain

An unauthenticated attacker identifies an internet-facing instance of code-projects Real State Services 1.0.
The attacker crafts a malicious HTTP POST request targeting the /addprojectrent.php endpoint.
Within the POST request, the attacker injects SQL payloads into the amen argument.
The vulnerable application processes the amen argument without adequate input validation or sanitization.
The malicious SQL payload is then executed directly within the application's backend database.
This successful injection allows the attacker to read, modify, or delete sensitive data within the database.
The attacker may also be able to gain unauthorized administrative access or exfiltrate confidential information, leading to data breaches.

Impact

Successful exploitation of CVE-2026-14746 can lead to severe consequences for organizations utilizing code-projects Real State Services 1.0. Attackers can gain full control over the application's database, allowing them to steal sensitive user data, property listings, or financial information. They could also manipulate or deface the website, insert malicious content, or compromise the integrity of the real estate listings. Given that the exploit has been publicly disclosed, organizations running this application are at an elevated risk of immediate data breaches, reputational damage, and operational disruption.

Recommendation

Immediately apply any available patches or updates provided by code-projects for Real State Services 1.0 to address CVE-2026-14746.
Implement robust input validation and sanitization for all user-supplied data, specifically focusing on the amen argument in /addprojectrent.php, to prevent SQL injection attacks.
Deploy a Web Application Firewall (WAF) to detect and block malicious HTTP requests containing SQL injection payloads, protecting against CVE-2026-14746.
Deploy the Sigma rule "Detects CVE-2026-14746 Exploitation — SQL Injection in Real State Services" to your SIEM and tune for your environment to identify attempted exploitation.

CVE-2026-14745: SQL Injection in code-projects Real State Services

hello@craftedsignal.io — Sun, 05 Jul 2026 12:20:55 +0000

A severe SQL injection vulnerability, identified as CVE-2026-14745, has been discovered in version 1.0 of the code-projects Real State Services application. The flaw resides within an unknown function associated with the /single-list_rent.php file, where improper sanitization of the ID argument allows unauthenticated attackers to inject and execute arbitrary SQL commands. This remote exploit poses a significant risk as it can be initiated without prior authentication, and a proof-of-concept exploit has been publicly disclosed, increasing the likelihood of widespread exploitation. Defenders should prioritize patching and implementing robust input validation to prevent attackers from compromising sensitive database information, modifying records, or potentially achieving remote code execution on the underlying server.

Attack Chain

Attacker discovers or targets a web server running code-projects Real State Services 1.0, potentially using publicly available exploit information for CVE-2026-14745.
The attacker crafts a malicious HTTP GET request targeting the vulnerable /single-list_rent.php endpoint.
A carefully constructed SQL injection payload is embedded within the ID URL parameter (e.g., /single-list_rent.php?ID=).
The vulnerable application component processes the ID parameter without adequate input validation or sanitization, leading to the concatenation and execution of the attacker's SQL query by the backend database.
Depending on the injected payload, the database executes commands such as extracting sensitive data (e.g., user credentials, property listings, application configuration) or modifying existing records.
The application's HTTP response, designed to display rental property details, inadvertently includes the results of the executed SQL query, allowing the attacker to exfiltrate the targeted data.
The attacker achieves unauthorized access to confidential information, can manipulate application data, or potentially escalate privileges to achieve remote code execution on the underlying server.

Impact

Successful exploitation of CVE-2026-14745 allows remote, unauthenticated attackers to gain unauthorized access to the application's underlying database. This can lead to the full compromise of sensitive data, including but not limited to user credentials, personal identifiable information of clients, property listings, and administrative records, directly affecting confidentiality. Attackers could also modify database contents, leading to data integrity issues such as altering property details or transaction records. In some cases, SQL injection vulnerabilities can be leveraged for remote code execution on the server, allowing for full system compromise. The availability of a public exploit significantly increases the risk of widespread attacks against organizations using this Real Estate Services application.

Recommendation

Immediately patch code-projects Real State Services 1.0 to a secure version if available, or remove the application from public access.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious web requests to /single-list_rent.php.
Implement a Web Application Firewall (WAF) to block known SQL injection patterns and monitor for attempts to exploit CVE-2026-14745, specifically traffic targeting /single-list_rent.php with suspicious ID parameters.
Review web server access logs for cs-uri-stem containing /single-list_rent.php and cs-uri-query containing SQL injection indicators (e.g., quotes, comments, boolean operators) to identify past or ongoing exploitation attempts.

CVE-2026-14744: Remote SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 12:19:55 +0000

A critical SQL injection vulnerability, identified as CVE-2026-14744, has been discovered in code-projects Real State Services version 1.0. This flaw, published on July 5, 2026, resides within an unspecified function of the /normalHomeRent.php file. An unauthenticated, remote attacker can exploit this vulnerability by manipulating the loc argument in an HTTP GET request, bypassing security controls and enabling direct interaction with the backend database. The public release of an exploit significantly escalates the risk, making this an immediate and high-priority concern for organizations utilizing this software. Successful exploitation can lead to unauthorized access to sensitive data, data manipulation, or, in severe cases, remote code execution on the underlying server, severely impacting data confidentiality, integrity, and system availability.

Attack Chain

An unauthenticated attacker identifies an internet-facing instance of code-projects Real State Services 1.0.
The attacker crafts a malicious HTTP GET request targeting the vulnerable /normalHomeRent.php endpoint.
The request includes a specifically engineered SQL injection payload embedded within the loc URL parameter (e.g., loc=' UNION SELECT NULL,version(),NULL,NULL-- -).
The vulnerable Real State Services application processes this request without adequate input sanitization or validation for the loc parameter.
The web application's backend code embeds the malicious payload directly into an SQL query that is sent to the database.
The backend database executes the manipulated SQL query, which may result in sensitive data being returned in the HTTP response, or the execution of arbitrary database commands.
The attacker retrieves the database's response, potentially gaining access to confidential information, modifying database records, or facilitating further system compromise.

Impact

Successful exploitation of CVE-2026-14744 grants remote, unauthenticated attackers the ability to perform SQL injection, leading to significant compromises. The primary impact includes unauthorized access to sensitive database information, such as user credentials, personal data, or proprietary business information. Attackers could also manipulate or delete data, severely affecting data integrity. In some scenarios, depending on the database configuration and type of SQL injection, remote code execution might be achievable on the server hosting the application, leading to full system compromise. With a public exploit available, the number of potential victims is high, spanning any organization or individual using the affected code-projects Real State Services 1.0 software.

Recommendation

Immediately apply patches or security updates for code-projects Real State Services 1.0 as they become available from the vendor, code-projects.
Deploy the Sigma rule provided in this brief to your SIEM/detection platform to identify attempts to exploit CVE-2026-14744.
Ensure web application firewalls (WAFs) are configured to detect and block common SQL injection patterns, specifically targeting the loc parameter in /normalHomeRent.php.
Implement strong input validation and parameterized queries in any custom web applications to prevent similar SQL injection vulnerabilities.
Review web server access logs for any suspicious requests targeting /normalHomeRent.php with unusual loc parameter values, especially those matching the IOCs or patterns in the Sigma rule.

CVE-2026-14743: Remote SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 12:18:59 +0000

A high-severity SQL injection vulnerability, tracked as CVE-2026-14743, has been identified in code-projects Real State Services version 1.0. The flaw specifically resides in an unknown function within the /normalHomeSale.php file. Attackers can exploit this vulnerability remotely and without authentication by manipulating the 'loc' argument, embedding malicious SQL queries directly into database commands. This can lead to unauthorized access, modification, or deletion of sensitive database information. The existence of a publicly available exploit significantly increases the risk of this vulnerability being actively abused by malicious actors, making immediate patching or mitigation crucial for any organization using the affected software.

Attack Chain

Reconnaissance: An attacker identifies an internet-facing instance of code-projects Real State Services 1.0.
Initial Access: The attacker sends a crafted HTTP GET or POST request to the vulnerable /normalHomeSale.php endpoint.
Vulnerability Exploitation: The attacker includes a specially malformed SQL injection payload within the loc parameter of the HTTP request.
Server-Side Processing: The vulnerable application processes the request, embedding the attacker-controlled loc parameter directly into an SQL query without proper sanitization.
SQL Injection: The database server executes the manipulated SQL query, granting the attacker unauthorized database access.
Data Compromise: The attacker can then exfiltrate sensitive data (e.g., user credentials, financial information), modify existing records, or inject new data into the database.
Impact: This leads to a compromise of data confidentiality, integrity, and potentially availability, depending on the attacker's objective.

Impact

Successful exploitation of CVE-2026-14743 could lead to severe consequences for organizations running code-projects Real State Services 1.0. Attackers can gain complete control over the application's database, allowing for the exfiltration of sensitive user data, modification of application content, or even complete data destruction. The impact extends to potential financial losses due to data breaches, reputational damage, and service disruption. While specific victim counts are not available, any organization utilizing this vulnerable software is at risk.

Recommendation

Patch CVE-2026-14743: Immediately apply any available patches or updates for code-projects Real State Services 1.0 as advised by the vendor. If no patch is available, remove or decommission the affected service.
Web Application Firewall (WAF): Implement or update WAF rules to detect and block common SQL injection patterns, especially targeting the /normalHomeSale.php endpoint and loc parameter, which can help prevent exploitation of CVE-2026-14743.
Deploy Detection Rule: Deploy the provided Sigma rule "Detect CVE-2026-14743 Exploitation - SQL Injection in Real State Services" to your SIEM/detection platform.
Enable Webserver Logging: Ensure comprehensive web server logging for HTTP requests, including cs-uri-stem and cs-uri-query parameters, to enable detection of exploitation attempts.