CVE-2015-20121

RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

CVSS 8.8 HIGHEPSS 0.4%CWE-89

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

15 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Next Click Ventures · RealtyScripts

Referências

https://www.exploit-db.com/exploits/38497 https://www.vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parameters http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php