Description (CNA)
Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Next Click Ventures / RealtyScripts | affected 4.0.2 |
CWE
CWE-89
References
- https://www.exploit-db.com/exploits/38497
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php
- https://www.vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parameters
ADP enrichment
No English description supplied.
No references supplied.