CVE-2026-14746: Real State Services 1.0 SQLi Vulnerability

CVE-2026-14746 Overview

CVE-2026-14746 is a SQL injection vulnerability in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php script, where the amen parameter is passed to a backend SQL query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability requires no authentication and no user interaction. Public disclosure of the exploit technique has occurred through VulDB and a GitHub issue, increasing the risk of opportunistic exploitation against exposed instances. The weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the amen parameter in /addprojectrent.php, enabling database read, modification, or extraction on affected Real State Services 1.0 deployments.

Affected Products

code-projects Real State Services 1.0
Deployments exposing /addprojectrent.php to untrusted networks
Downstream forks or derivative applications reusing the vulnerable code path

Discovery Timeline

2026-07-05 - CVE-2026-14746 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14746

Vulnerability Analysis

The vulnerability resides in the /addprojectrent.php endpoint of code-projects Real State Services 1.0. The amen request parameter is concatenated into a SQL statement without prepared statements or input validation. An attacker submits crafted SQL syntax through this parameter, altering the intended query logic.

Because the endpoint is reachable over the network and requires no credentials, exploitation only requires HTTP access to the target. Attackers can enumerate the database schema, extract records, or manipulate stored data. The Exploit Prediction Scoring System (EPSS) probability is 0.269% with a percentile of 18.511, reflecting a moderate probability of near-term exploitation activity.

Root Cause

The application constructs SQL queries by directly interpolating user-controlled input from the amen parameter into the query string. The absence of parameterized queries, type enforcement, or input filtering allows special SQL characters to break out of the intended context. This pattern falls under [CWE-74], improper neutralization of special elements in output used by a downstream component.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP request to /addprojectrent.php with a malicious payload placed in the amen parameter. Typical exploitation techniques include boolean-based blind, error-based, or UNION-based SQL injection payloads. Public exploit details are referenced in the GitHub Issue for CVE-2026-14746 and the VulDB CVE-2026-14746 Detail entry.

No verified proof-of-concept code is included here. Refer to the linked advisories for technical payload details.

Detection Methods for CVE-2026-14746

Indicators of Compromise

HTTP POST or GET requests to /addprojectrent.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences in the amen parameter
Web server logs showing anomalous response sizes or 500-series errors originating from /addprojectrent.php
Database logs containing malformed queries referencing tables not normally accessed by the addprojectrent workflow

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the amen parameter
Enable database query logging and alert on syntax errors or queries generated from the rent submission endpoint
Correlate application error rates with source IP behavior to identify automated injection scanners

Monitoring Recommendations

Monitor authentication-less endpoints under /addprojectrent.php for spikes in request volume from single sources
Ingest web server, application, and database logs into a centralized analytics platform for cross-source correlation
Track outbound data volumes from the database host to detect bulk extraction attempts following suspected injection

How to Mitigate CVE-2026-14746

Immediate Actions Required

Restrict network access to /addprojectrent.php to trusted administrative networks until a fix is deployed
Deploy WAF rules blocking SQL metacharacters and known injection payloads on the amen parameter
Audit database accounts used by the application and revoke unnecessary privileges to limit injection impact

Patch Information

No official vendor patch has been published at the time of this writing. Refer to the Code Projects Resource Hub and the VulDB Vulnerability #376332 entry for updated remediation status. Organizations should replace direct string concatenation in /addprojectrent.php with parameterized queries or prepared statements for the amen parameter and all other user-controlled inputs.

Workarounds

Apply server-side input validation that rejects non-alphanumeric characters in the amen parameter where the business logic allows
Route the affected endpoint through a reverse proxy enforcing strict request schemas
Run the database service with a least-privilege account that cannot alter schema or read sensitive tables

bash

# Example ModSecurity rule blocking SQL metacharacters in the amen parameter
SecRule ARGS:amen "@rx (?i)(\bunion\b|\bselect\b|--|;|/\*|\bsleep\s*\()" \
    "id:1014746,phase:2,deny,status:403,log,msg:'CVE-2026-14746 SQLi attempt on amen parameter'"