A critical SQL injection vulnerability in Inout RealEstate allows unauthenticated attackers to manipulate database queries and exfiltrate sensitive information.

The application fails to properly sanitize user input within the city parameter of the agents/agentlistdetails endpoint. This allows an unauthenticated attacker to inject arbitrary SQL commands via POST requests to compromise the backend database.

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.2, this vulnerability could lead to the unauthorized disclosure of sensitive user or business data, potentially resulting in significant reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is available, administrators should restrict access to the affected agents/agentlistdetails endpoint at the network or application level.

Proactive Monitoring: Review web server logs for suspicious POST requests containing SQL syntax, such as RLIKE, SELECT, or CASE statements, specifically targeting the city parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide virtual patching while the underlying code remains vulnerable.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit-DB entry 46631.

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, this vulnerability represents a significant and actionable risk. Organizations utilizing Inout RealEstate must implement immediate compensating controls and restrict access to the vulnerable endpoint to prevent potential data exfiltration.