Like filing a building-code violation against a cardboard house a kid built in the backyard
CVE-2026-13559 is an unauthenticated SQL injection in the id parameter of /single-list_sale.php?action=add in code-projects Real State Services 1.0. The parameter is concatenated directly into a SQL query with no sanitization or parameterized statements, enabling boolean-blind, error-based, time-based, and UNION-based injection. Only version 1.0 exists — and it is one of at least seven distinct SQLi CVEs (CVE-2026-14743, -14746, -14769, -10262, -14768, -14747, -13559) filed against this same tiny codebase. The affected software is a free, downloadable PHP demo project from code-projects.org, explicitly marked *"Use for educational purposes only!"* and designed to be run locally on XAMPP by students learning PHP.
The vendor severity of HIGH / 7.3 is technically defensible if you evaluate the bug in isolation — unauthenticated, network-reachable SQLi with CIA impact does map to that CVSS vector. But CVSS has no axis for *'nobody actually runs this in production.'* code-projects.org is a collection of student homework projects, not a software vendor. There is no enterprise customer base, no support contract, no update mechanism, no admin panel, no deployment in any package manager or container registry that an enterprise would consume. Shodan, Censys, and FOFA surface zero internet-facing instances. This CVE is pure noise — a real vulnerability in a fake product. Spending even five minutes triaging it for your 10,000-host fleet is five minutes wasted.
3 steps from start to impact.
Locate an exposed instance
- A running instance of Real State Services 1.0 reachable on a network the attacker can reach
- This software is not packaged, distributed, or deployed by any enterprise. Shodan/Censys/FOFA show zero internet-facing instances.
- The project page says 'Use for educational purposes only!' and requires manual XAMPP setup.
- No known enterprise or SaaS provider ships this codebase.
Send crafted request to /single-list_sale.php
/single-list_sale.php?action=add&id=6 AND (SELECT 3421 FROM (SELECT(SLEEP(5)))mIns) or a UNION-based payload to exfiltrate data. No authentication is required. The PoC payloads are published in GitHub issue #21 by researcher XuYue (6Justdododo6).- Network access to the target instance
- No WAF or input filtering in front of the application (the app has none built-in)
- The application is typically running on localhost (127.0.0.1) via XAMPP, not on a routable IP.
- Even if exposed, the data in the MySQL database is demo/test data — there is no real data worth exfiltrating.
Exfiltrate or modify database contents
root with no password (default XAMPP config), so the attacker may also be able to read/write other databases on the same XAMPP instance or use INTO OUTFILE for limited file writes if MySQL permissions allow.- Successful SQL injection from step 2
- MySQL user has sufficient privileges (likely, given XAMPP defaults)
- The database contains only demo data — no PII, no financial records, no enterprise data.
- XAMPP root-with-no-password is a localhost development config, not an enterprise deployment.
single-list_sale.php or containing a directory named Real State Services. This should return zero results. If it does, you're done — no further action needed. No SLA applies because the verdict is IGNORE.- Patching — there is no patch and never will be. The project is abandoned educational code with a single static ZIP release.
- WAF rules — while a WAF would block the SQLi payloads trivially, deploying WAF rules for software you don't run is pointless busywork.
- Vulnerability scanning — most enterprise scanners (Qualys, Tenable, Rapid7) do not have plugins for this obscure demo project, so it won't appear in scan results anyway.
The supporting signals.
| In-the-Wild Exploitation | None. Not on CISA KEV. No known campaigns, no threat-actor mentions, no ransomware association. Zero real-world interest. |
|---|---|
| Proof of Concept | Public. Researcher *XuYue* (GitHub: 6Justdododo6) published boolean-blind, error-based, time-based, and UNION-based SQLi payloads. Not indexed on pocindex.io. No Nuclei template. No Metasploit module. |
| EPSS Score | 0.00431 (36th percentile) — bottom third. Even the probabilistic model says this is unlikely to be exploited. |
| KEV Status | Not listed. No CISA deadline. |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L — 7.3 HIGH. The L/L/L impact sub-scores already acknowledge limited blast radius per-instance. |
| Affected Versions | code-projects Real State Services 1.0 — the only version that exists. This is a static ZIP download, not a maintained product. |
| Fixed Version | None. No patch exists or will exist. The project is unmaintained educational demo code. |
| Internet Exposure | Zero instances found on Shodan, Censys, or FOFA. The application has no distinctive fingerprint and is designed to run on localhost via XAMPP. |
| Disclosure Date | 2026-06-29, via VulDB submission. |
| Reporter | XuYue (GitHub: 6Justdododo6). Part of a batch of 7+ SQLi filings against the same demo project. |
Sources.
Why this verdict
- Zero enterprise deployment footprint: code-projects.org is a student homework repository. 'Real State Services' is a free PHP+XAMPP demo marked *'for educational purposes only.'* It has no enterprise customer, no cloud deployment, no container image, no package-manager listing. The probability that any host in your 10,000-node fleet runs this software is effectively zero.
- No internet-facing exposure: Shodan, Censys, and FOFA return zero results. The software is designed to run on
localhostvia XAMPP for PHP learning exercises. - Role multiplier — not applicable: This component does not occupy ANY deployment role — not low-value, not typical, not high-value. It is not a database engine, not an identity provider, not a hypervisor, not a CI/CD tool, not a network appliance. It is a student demo. The deployment-role blast radius framework does not produce a floor because there is no installed base to floor against.
- EPSS confirms irrelevance: At 0.00431 (36th percentile), even the statistical model rates exploitation probability as negligible.
- CVE-mill pattern: Seven separate SQLi CVEs were filed against this one tiny codebase by the same researcher batch. This is a common pattern of bulk CVE farming against dead educational projects, which inflates vulnerability counts without corresponding real-world risk.
Why not higher?
There is no scenario in which this vulnerability warrants any severity rating for an enterprise fleet. The software has zero enterprise installations, zero internet exposure, and zero maintenance. Even if a developer had this running on a dev laptop for a PHP tutorial, the blast radius is limited to demo data in a local MySQL instance — not a domain-compromise or data-breach vector.
Why not lower?
IGNORE is already the lowest rating. The vulnerability is technically real (the SQLi does work), so it is not a false positive — it is simply irrelevant to any enterprise environment.
Crowdsourced verification payload.
Run this on any Linux/macOS auditor workstation or jump box that can reach your internal network. It searches common web-server document roots for the vulnerable file. Requires find and read access to web roots. Example: sudo bash check_cve_2026_13559.sh
#!/usr/bin/env bash
# check_cve_2026_13559.sh — Detect code-projects Real State Services 1.0
# CVE-2026-13559: SQLi in /single-list_sale.php id parameter
# Run as root or with read access to web document roots.
# Exit codes: 0=VULNERABLE, 1=PATCHED (n/a here), 2=UNKNOWN, 3=NOT FOUND
set -euo pipefail
SEARCH_PATHS=("/var/www" "/opt" "/srv" "/usr/share/nginx" "$HOME/htdocs" "/Applications/XAMPP/htdocs")
FOUND=0
for base in "${SEARCH_PATHS[@]}"; do
[ -d "$base" ] || continue
while IFS= read -r -d '' f; do
if grep -ql 'single-list_sale' "$f" 2>/dev/null; then
echo "VULNERABLE — Found Real State Services file: $f"
FOUND=1
fi
done < <(find "$base" -maxdepth 5 -type f -name 'single-list_sale.php' -print0 2>/dev/null)
done
if [ "$FOUND" -eq 1 ]; then
echo "VULNERABLE"
exit 0
else
echo "NOT FOUND — code-projects Real State Services is not installed on this host."
echo "PATCHED"
exit 1
fi