CVE-2026-14745: Real Estate Services 1.0 SQLi Vulnerability

CVE-2026-14745 Overview

CVE-2026-14745 is a SQL injection vulnerability in code-projects Real State Services 1.0. The flaw resides in the /single-list_rent.php script, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. No authentication or user interaction is required to trigger the flaw. Public exploit code is available, increasing the risk of opportunistic attacks against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the backend database, exposing rental listings, user records, and credentials.

Affected Products

code-projects Real State Services 1.0
/single-list_rent.php endpoint
Deployments exposing the vulnerable PHP application to untrusted networks

Discovery Timeline

2026-07-05 - CVE-2026-14745 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14745

Vulnerability Analysis

The vulnerability affects the single-list_rent.php script within the Real State Services 1.0 application. The script accepts an ID parameter through an HTTP request and concatenates the value directly into a SQL query. Because the parameter is not validated, escaped, or bound as a prepared statement, an attacker can break out of the intended query context. This allows arbitrary SQL syntax to be appended, executed, and returned by the backend database. According to VulDB, proof-of-concept exploitation details have been disclosed publicly.

Root Cause

The root cause is improper neutralization of special elements in downstream components [CWE-74]. The ID argument passed to /single-list_rent.php flows directly into a dynamic SQL statement without parameterized queries or input filtering. Any attacker-controlled string in that parameter is interpreted as SQL rather than data.

Attack Vector

Exploitation occurs over the network with low attack complexity. The attacker sends a crafted HTTP GET or POST request to /single-list_rent.php containing a malicious ID value. No credentials are required. Typical payloads use UNION-based, boolean-based, or time-based blind injection techniques to extract data, bypass authentication logic, or read information from adjacent tables in the same database schema.

The vulnerability is described in prose because no verified exploit code is published in the referenced advisories. See the GitHub CVE Issue and VulDB CVE-2026-14745 entries for technical details.

Detection Methods for CVE-2026-14745

Indicators of Compromise

HTTP requests to /single-list_rent.php containing SQL meta-characters such as single quotes, UNION, SELECT, SLEEP(, or -- in the ID parameter.
Web server access logs showing unusually long or URL-encoded ID values from a small set of source IPs.
Database error messages or query latency spikes correlated with requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the ID query parameter for SQL injection patterns on the single-list_rent.php route.
Enable database query logging and alert on UNION SELECT, INFORMATION_SCHEMA, or time-delay functions issued by the web application user.
Correlate web access logs with database audit logs to identify anomalous query volume tied to a single client session.

Monitoring Recommendations

Monitor outbound data volume from the database server, since SQL injection frequently precedes bulk data exfiltration.
Track authentication anomalies for accounts stored in the application database, which may indicate credential theft following exploitation.
Baseline normal request patterns to /single-list_rent.php and alert on deviations in parameter length, encoding, or frequency.

How to Mitigate CVE-2026-14745

Immediate Actions Required

Restrict network exposure of the Real State Services 1.0 application until a fix is validated, using firewall rules or reverse-proxy access controls.
Deploy WAF rules that block SQL injection payloads targeting the ID parameter of /single-list_rent.php.
Rotate database credentials and application secrets if exploitation is suspected in access logs.

Patch Information

No official vendor patch has been referenced in the advisories for CVE-2026-14745 at the time of publication. Consult the Code Projects site and the VulDB advisory for updates. Operators should modify the vulnerable code to use parameterized queries or prepared statements when handling the ID argument.

Workarounds

Replace dynamic SQL concatenation in single-list_rent.php with prepared statements using PDO or MySQLi parameter binding.
Enforce strict server-side input validation, allowing only integer values for the ID parameter.
Apply the principle of least privilege to the database account used by the web application, limiting it to read-only access on required tables.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /single-list_rent.php" \
  "chain,phase:2,deny,status:403,id:1014745,msg:'CVE-2026-14745 SQLi attempt'"
  SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|/\*)" \
    "t:none,t:urlDecodeUni"