Next Click Ventures RealtyScript 4.0.2 contains critical SQL injection vulnerabilities that allow unauthenticated attackers to compromise database integrity and extract sensitive information.

The software fails to properly sanitize user-supplied input in the u_id GET parameter and the agent[] POST parameter before using them in database queries. This allows an unauthenticated attacker to execute arbitrary SQL commands, including time-based blind injection techniques.

Successful exploitation allows an unauthorized attacker to read, modify, or delete sensitive information from the underlying database, potentially leading to a complete compromise of application data. With a CVSS score of 8.2, this vulnerability represents a high risk to business operations, as it could lead to unauthorized access to customer records, administrative credentials, or cause significant service disruption via resource exhaustion.

Immediate Action: There is currently no official patch from the vendor for this legacy software, so administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Security teams should review server access logs for anomalous GET requests containing SQL syntax or sleep commands and monitor database performance for unusual latency spikes associated with blind injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns, specifically targeting the u_id and agent[] parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 38497.

Given the availability of public exploit code and the critical nature of SQL injection, immediate mitigation is required. If the application cannot be updated or replaced, strict network-level access controls must be implemented to prevent unauthenticated access to the vulnerable administrative endpoints.