A critical SQL injection vulnerability in Netartmedia PHP Real Estate Agency 4.0 allows unauthenticated attackers to execute arbitrary database queries and potentially compromise sensitive information.

This is an SQL injection vulnerability (CWE-89) triggered by improper neutralization of special elements in the features[] parameter. An unauthenticated attacker can send crafted POST requests to index.php to manipulate backend database queries.

Successful exploitation of this vulnerability allows unauthorized access to the application database. This could lead to the exposure of sensitive customer data, administrative credentials, or the modification of site content. Given the CVSS score of 8.2, this flaw represents a high risk to business operations and data integrity.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web application or disable the vulnerable features parameter if possible.

Proactive Monitoring: Review web server access logs for anomalous POST requests to index.php, specifically monitoring for SQL syntax or keywords within the features[] parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the features[] parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists via the Exploit-DB entry 46574.

Due to the lack of an official vendor patch and the presence of a public proof-of-concept, this vulnerability poses an immediate risk to any deployment of Netartmedia PHP Real Estate Agency 4.0. Organizations should isolate the affected instance from the internet until a secure version is available or the code is remediated to prevent unauthorized database access.