An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized data access and database manipulation.

This is a SQL injection vulnerability within the /addprojectsale.php file, specifically triggered via the 'amen' parameter. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized interaction with the underlying database.

The vulnerability carries a CVSS score of 7.3, reflecting its high severity and potential for significant impact. Successful exploitation could lead to the exposure of sensitive real estate data, unauthorized modification or deletion of records, and potential privilege escalation, resulting in severe operational disruption and reputational damage.

Immediate Action: As no patch is currently available, restrict access to the /addprojectsale.php endpoint and implement strict input validation for the 'amen' parameter.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically those containing SQL syntax characters (e.g., ' OR 1=1 --) originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection attempts targeting the affected application parameters.

Public Exploit Available: false

Given the ability for unauthenticated actors to compromise the database, organizations using this software should prioritize isolating the affected component. Until a formal vendor patch is released, strict input sanitization and WAF filtering are essential to mitigate the risk of unauthorized data manipulation.