A critical SQL injection vulnerability in Next Click Ventures RealtyScript 4.0.2 allows unauthenticated remote attackers to compromise sensitive database contents.

The application fails to properly sanitize input provided to the GET parameter u_id and the POST parameter agent[]. This flaw allows an unauthenticated attacker to inject malicious SQL commands, enabling time-based blind data exfiltration from the underlying database.

Successful exploitation of this vulnerability permits unauthorized access to the entire database backend, potentially exposing sensitive customer data, real estate listings, and administrative credentials. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to significant data breaches, regulatory non-compliance, and severe reputational damage to the organization.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administrative interfaces where these parameters are processed, ideally by placing them behind a VPN or IP-based access control list.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax, such as "SLEEP" commands or unexpected time delays, which are indicative of automated blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting time-based payloads and suspicious character sequences in the u_id and agent[] parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 38497.

The presence of a publicly available proof-of-concept, combined with the lack of a vendor-provided patch, necessitates immediate defensive action. Organizations running RealtyScript 4.0.2 must prioritize limiting exposure by isolating the application from the public internet and implementing strict WAF filtering to prevent unauthorized data exfiltration until a permanent fix is developed.