Description

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T11:16:40.850Z",
  "pubdate": "2026-08-24T11:16:40.850Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the itourcecode Real Estate Management System 1.0, specifically within the search.php script. This security flaw stems from improper sanitization and validation of user-supplied input parameters processed by the underlying database query engine. The vulnerability allows remote attackers to manipulate specific query arguments—namely search, delivery_type, search_price, and property_type—to inject arbitrary SQL commands. Successful exploitation of this vulnerability can lead to unauthorized access, disclosure, modification, or deletion of sensitive database contents, posing severe risks to the confidentiality, integrity, and availability of the affected system. The attack can be initiated remotely without requiring prior authentication, and because the exploit details are publicly available, the risk of active exploitation is elevated. Mitigating this issue requires immediate remediation of the vulnerable source code to enforce parameterized queries or robust input sanitization across all affected parameters.",
  "technicalDetails": "The vulnerability resides in the search.php file of the itourcecode Real Estate Management System 1.0. The root cause of the issue is the direct and insecure concatenation of user-controlled input into dynamic SQL queries without adequate parameterization, input validation, or escaping mechanisms. Specifically, the parameters search, delivery_type, search_price, and property_type accept raw input from HTTP GET or POST requests and pass it directly to the backend database management system.\nThe attack flow begins when an unauthenticated remote attacker crafts a malicious HTTP request targeting the search.php endpoint. Within this request, the attacker injects specially crafted SQL payload strings into one or more of the vulnerable parameters: search, delivery_type, search_price, or property_type. Because the application fails to properly sanitize or parameterize these inputs, the database interpreter parses the injected characters as executable SQL syntax rather than literal data.\nUpon execution, the modified SQL query alters the original query logic devised by the application developer. Depending on the constructed payload, the attacker can leverage UNION-based techniques to extract data from other database tables, execute blind SQL injection inferences, or manipulate database records. The network exposure is high, as the vulnerable script is accessible remotely over standard HTTP protocols. The exploitation requirements are minimal, requiring only network connectivity to the target application and knowledge of the vulnerable input vectors. Post-exploitation impact includes complete database compromise, potential administrative data exposure, and unauthorized data manipulation."
}