The vulnerability is an SQL injection in the addprojectrent.php file of code‑projects Real State Services 1.0. By supplying a crafted value for the amen query parameter, an attacker can inject arbitrary SQL statements because the input is concatenated directly into a query string without sanitization. Successful exploitation would allow the attacker to read, modify or delete database records that belong to the application.

The flaw appears in version 1.0 of code‑projects Real State Services. The CVE indicates that the vulnerability resides in an unspecified function of addprojectrent.php handling the amen parameter. All installations of this product running that version are potentially vulnerable until a fix addresses the unchecked input.

The CVSS score of 6.9 reflects moderate severity. The EPSS score is less than 1 %, indicating a low probability of exploitation observed in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw remotely over the web by sending a crafted value in the amen field. If successful, the attacker can manipulate the application’s database content, potentially compromising confidentiality and integrity of stored data.