CVE-2025-2384: Real Estate Management System SQLi Flaw

CVE-2025-2384 Overview

CVE-2025-2384 is a SQL injection vulnerability in code-projects Real Estate Property Management System 1.0. The flaw resides in the /InsertCustomer.php script, which acts as the Parameter Handler component for new customer records. Attackers can manipulate the txtName, txtAddress, cmbCity, txtEmail, cmbGender, txtBirthDate, txtUserName2, or txtPassword2 parameters to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires only low-level privileges. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact
Remote attackers with low privileges can inject arbitrary SQL queries through the customer registration endpoint, exposing stored credentials, customer records, and property data.

Affected Products

Fabian Real Estate Property Management System 1.0
code-projects Real Estate Property Management System (/InsertCustomer.php)
Deployments exposing the Parameter Handler component to untrusted networks

Discovery Timeline

2025-03-17 - CVE-2025-2384 published to the National Vulnerability Database (NVD)
2025-10-23 - Last updated in the NVD database

Technical Details for CVE-2025-2384

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] resulting from improper neutralization of special elements in a downstream component [CWE-74]. The /InsertCustomer.php endpoint accepts user-supplied POST parameters and concatenates them directly into a SQL INSERT statement without parameterization. An authenticated user with low privileges submits a crafted value in any of the eight affected fields. The database engine then interprets the injected fragment as SQL code rather than data. Successful exploitation can disclose database contents, modify customer records, and pivot to additional tables in the management system.

Root Cause

The root cause is the absence of prepared statements and input sanitization in the customer insertion routine. The PHP code passes raw request parameters into the query string, allowing attackers to break out of the intended string literal context. The application also lacks server-side validation that constrains field formats such as email, date of birth, or username.

Attack Vector

The attack vector is network-based. An attacker authenticates to the application with low privileges, then submits a POST request to /InsertCustomer.php containing SQL metacharacters in fields such as txtUserName2. No user interaction is required beyond submitting the request. The exploit has been disclosed publicly and may be used by opportunistic attackers.

No verified public exploit code is referenced in the NVD entry. Technical details are described in the GitHub CVE SQL Overview and VulDB entry #299883.

Detection Methods for CVE-2025-2384

Indicators of Compromise

POST requests to /InsertCustomer.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or OR 1=1 in the txtName, txtAddress, cmbCity, txtEmail, cmbGender, txtBirthDate, txtUserName2, or txtPassword2 parameters
Database error messages or HTTP 500 responses correlated with requests to the customer insertion endpoint
Unexpected INSERT statements or new administrative accounts appearing in the application database
Outbound DNS or HTTP callbacks originating from the database server following customer registration requests

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns submitted to /InsertCustomer.php
Enable verbose query logging on the backing database and alert on queries that include comment tokens or stacked statements from the application user
Correlate authenticated session activity with anomalously long or specially encoded form field values

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized analytics platform for retrospective hunting
Monitor for new accounts created through the customer registration workflow outside of expected business hours
Track HTTP response codes and response sizes for /InsertCustomer.php to identify enumeration attempts

How to Mitigate CVE-2025-2384

Immediate Actions Required

Restrict network access to the Real Estate Property Management System until a patched version is available
Disable or place the /InsertCustomer.php endpoint behind authentication and IP allow-listing
Audit the customer and user tables for unauthorized records or modified credentials
Rotate database credentials and application secrets if exploitation is suspected

Patch Information

No vendor advisory or official patch has been published for CVE-2025-2384 at the time of the NVD record. Operators should monitor the code-projects portal for updates. Until a fix is available, treat the application as vulnerable and apply compensating controls.

Workarounds

Place a WAF in front of the application with signatures that block SQL injection payloads on form parameters
Configure the database account used by the application with the least privileges required, removing DROP, ALTER, and cross-database access
Patch the source manually by rewriting the INSERT query in /InsertCustomer.php to use parameterized queries via PDO or mysqli prepared statements
Add server-side input validation that enforces strict type, length, and format constraints on each field

bash

# Example ModSecurity rule to block SQL metacharacters on the vulnerable endpoint
SecRule REQUEST_URI "@streq /InsertCustomer.php" \
  "id:1002384,phase:2,deny,status:403,\
   chain,msg:'CVE-2025-2384 SQLi attempt blocked'"
  SecRule ARGS:txtName|ARGS:txtAddress|ARGS:cmbCity|ARGS:txtEmail|ARGS:cmbGender|ARGS:txtBirthDate|ARGS:txtUserName2|ARGS:txtPassword2 \
    "@rx (?i)(\bunion\b.*\bselect\b|--|;|/\*|\bor\b\s+1=1)"