CVE-2015-20121

HIGH

RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-20121. PoCs published by LiquidWorm.

AI-analyzed exploit summary The exploit demonstrates time-based blind SQL injection vulnerabilities in RealtyScript v4.0.2 via the 'u_id' GET parameter and 'agent[]' POST parameter. It includes functional payloads and sqlmap session output confirming the vulnerability.

Description

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappsphp
https://www.exploit-db.com/exploits/38497

The exploit demonstrates time-based blind SQL injection vulnerabilities in RealtyScript v4.0.2 via the 'u_id' GET parameter and 'agent[]' POST parameter. It includes functional payloads and sqlmap session output confirming the vulnerability.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: RealtyScript v4.0.2
Auth required
Prerequisites: Access to the admin interface · Valid session cookie
devstral-2 · analyzed Mar 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-38497
https://www.exploit-db.com/exploits/38497
Vendor Advisory vendor-advisory
Vulnerability Advisory
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php
Third Party Advisory third-party-advisory
VulnCheck Advisory: RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters
https://www.vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parameters

Scores

CVSS v3 8.2
EPSS 0.0042
EPSS Percentile 33.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
Next Click Ventures/RealtyScripts 4.0.2
nextclickventures/realtyscript 4.0.2
Published Mar 16, 2026
Tracked Since Mar 16, 2026