Executive brief
Real State Services is a web application used for managing property listings. A security flaw in the application's property viewing component allows an attacker to interfere with the underlying database. This could lead to the unauthorized viewing of sensitive information, modification of property data, or disruption of the service.
Technical details
A SQL injection vulnerability exists in code-projects Real State Services 1.0 within the 'single-list_sale.php' file. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a SQL query. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to the 'action=add' endpoint. Successful exploitation allows for boolean-based, error-based, time-based, and UNION-based SQL injection, potentially leading to full database extraction or unauthorized data modification. A public exploit (PoC) has been released.
Affected products
- code-projects Real State Services 1.0
Timeline
- 2026-05-10: disclosed: Initial discovery and report on GitHub by user 6Justdododo6
- 2026-06-29: advisory: CVE published and NVD record created