A critical SQL injection vulnerability in code-projects Real State Services 1.0 permits unauthenticated attackers to execute arbitrary database commands, posing a significant risk of data compromise.

This is an SQL injection vulnerability located within the /normalHomeRent.php file. It allows unauthenticated remote attackers to manipulate the 'loc' parameter to inject and execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, potential data modification, or complete database compromise. Given the CVSS score of 7.3 (High), the ability for unauthenticated remote attackers to bypass security controls and interact directly with the database poses a severe threat to the confidentiality and integrity of business data.

Immediate Action: Since no specific patch version is currently available, contact the vendor for security updates or, if possible, remove the vulnerable component from public access.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /normalHomeRent.php containing SQL-related characters or patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the 'loc' parameter.

Public Exploit Available: true

The presence of a public exploit for this unauthenticated SQL injection flaw makes it a high-priority risk. Organizations using code-projects Real State Services 1.0 must prioritize the implementation of WAF filtering and strict access controls until an official security patch is released by the vendor.