CVE-2026-14747: Real State Services 1.0 SQLi Vulnerability

CVE-2026-14747 Overview

CVE-2026-14747 is a SQL injection vulnerability in code-projects Real State Services 1.0. The flaw resides in the /addprojectsale.php endpoint, where the amen parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. It is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the amen parameter in /addprojectsale.php, potentially exposing or modifying data stored in the application database.

Affected Products

code-projects Real State Services 1.0
/addprojectsale.php endpoint
Deployments exposing the vulnerable script to untrusted networks

Discovery Timeline

2026-07-05 - CVE CVE-2026-14747 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14747

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the addprojectsale.php script of code-projects Real State Services 1.0. The amen HTTP parameter is concatenated into a SQL statement without parameterization or input validation. An attacker can submit crafted input to alter the query logic, extract database contents, or manipulate stored records.

Because the endpoint is reachable over the network and requires no privileges, exploitation can be automated. The EPSS score of 0.269% (18.5 percentile) reflects the current probability of observed exploitation, though public proof-of-concept references exist through VulDB and the GitHub CVE Issue Tracker.

Root Cause

The root cause is improper neutralization of user-supplied input in a downstream SQL query. The application accepts the amen argument from the client and embeds it directly in a query string sent to the backend database. No prepared statements, parameter binding, or escaping mechanisms filter the input.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends a crafted HTTP request to /addprojectsale.php with a malicious payload in the amen parameter. The injected SQL is executed by the database engine in the context of the application's database user. Depending on the account's privileges, this can lead to disclosure of records, modification of stored data, or execution of database-level administrative functions.

No verified exploitation code is published by the vendor. Technical descriptions are available in the VulDB CVE #CVE-2026-14747 entry and the VulDB Vulnerability #376333 record.

Detection Methods for CVE-2026-14747

Indicators of Compromise

HTTP POST or GET requests to /addprojectsale.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the amen parameter
Unexpected database errors logged when parsing the amen argument
Anomalous outbound data volume from the web application host following requests to addprojectsale.php

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the amen parameter for SQL injection signatures
Enable database query logging and alert on unusually long queries, UNION SELECT statements, or errors originating from addprojectsale.php
Correlate web access logs with database audit logs to identify injection attempts targeting the vulnerable endpoint

Monitoring Recommendations

Monitor HTTP request rates and payload length against /addprojectsale.php for automated scanning behavior
Track authentication and privilege changes on the application database user account
Review web server access logs daily for repeated 500-series responses tied to the vulnerable script

How to Mitigate CVE-2026-14747

Immediate Actions Required

Restrict network access to the /addprojectsale.php endpoint until a fix is applied
Deploy WAF signatures blocking SQL metacharacters in the amen parameter
Audit the application database for unauthorized modifications or new privileged accounts

Patch Information

At the time of publication, no vendor patch is listed in the referenced advisories. Administrators should monitor the Code Projects Resource Hub and the GitHub CVE Issue Tracker for updates. Until an official fix is available, code-level remediation requires replacing string concatenation with parameterized queries in addprojectsale.php.

Workarounds

Modify addprojectsale.php to use prepared statements with bound parameters for the amen argument
Apply server-side input validation restricting amen to an expected character set and length
Enforce least privilege on the application database account to limit the impact of successful injection
Isolate the application behind authenticated access controls until code changes are deployed

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the amen parameter
SecRule ARGS:amen "@rx (?i)(union(\s|\+)+select|--|';|/\*|sleep\(|benchmark\()" \
    "id:1026147470,phase:2,deny,status:403,\
    msg:'CVE-2026-14747 SQL injection attempt in amen parameter'"