An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized database manipulation and potential data compromise.

This vulnerability is a classic SQL injection flaw (CWE-89) triggered by insufficient input validation in the 'loc' parameter within the /normalHomeSale.php file. Because this endpoint does not require authentication, remote attackers can interact with the application database without prior access credentials.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification, or deletion of sensitive real estate records. Such an incident could result in significant reputational damage, loss of data integrity, and potential non-compliance with data privacy regulations.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the vulnerable /normalHomeSale.php endpoint or take the application offline until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server and database logs for anomalous query patterns, particularly those containing SQL syntax or unexpected input strings directed at the loc parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application's input parameters.

Public Exploit Available: true

Due to the availability of public exploits and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for immediate remediation. Organizations using code-projects Real State Services 1.0 must implement strict WAF filtering or isolate the affected service to prevent unauthorized database access until an official vendor patch is released.