CVE-2025-1379
Published: 17 February 2025
Summary
CVE-2025-1379 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Real Estate Property Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1379 is a critical SQL injection vulnerability affecting code-projects Real Estate Property Management System 1.0. The issue resides in an unknown functionality of the file /Admin/CustomerReport.php, where manipulation of the "city" argument enables SQL injection. Published on 2025-02-17, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs-74 and CWE-89.
The vulnerability is remotely exploitable by low-privileged users (PR:L) with low attack complexity and no user interaction required. Attackers can inject malicious SQL via the "city" parameter to compromise confidentiality, integrity, and availability at a low level, potentially allowing limited data access, modification, or disruption within the application's database context. A proof-of-concept exploit has been publicly disclosed.
Advisories on VulDB (ctiid.295987, id.295987, submit.501070) and the project site at code-projects.org provide further details, alongside a GitHub-hosted POC at https://github.com/1337g/realestatepropertymanagement_poc/blob/main/gu3.pdf. No specific patches or mitigations are detailed in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2136
Vulnerability details
A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/CustomerReport.php. The manipulation of the argument city leads to sql injection. The…
more
attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/Admin/CustomerReport.php) enables exploitation of public-facing applications (T1190), abuse of server software components (T1505 as cited in advisory), and collection of data from databases via arbitrary SQL queries (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of the 'city' parameter in /Admin/CustomerReport.php to block malicious SQL injection payloads.
SI-2 mandates timely remediation of the SQL injection flaw in the Real Estate Property Management System 1.0.
SI-9 restricts the 'city' argument to authorized types, formats, and volumes, reducing SQL injection attack surface.