Executive brief
A security vulnerability exists in Real State Services, a web application used for managing real estate transactions. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of records. This issue can be exploited remotely without requiring any user credentials or special access.
Technical details
A SQL injection vulnerability exists in code-projects Real State Services 1.0 within the 'pay.php' file. The root cause is the improper neutralization of special elements in the 'Bankname' POST parameter, which is used directly in SQL queries without adequate validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending specially crafted payloads (including boolean-based blind, error-based, and time-based blind techniques) to manipulate database queries. This can result in unauthorized data retrieval, modification, or full database compromise. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Real State Services 1.0
Timeline
- 2026-06-05: disclosed: Initial disclosure on GitHub by user 6Justdododo6
- 2026-07-05: advisory: NVD publication date