CVE-2015-20121

HIGH

RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

Title source: cna
STIX 2.1

Description

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappsphp
https://www.exploit-db.com/exploits/38497

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-38497
https://www.exploit-db.com/exploits/38497
Vendor Advisory vendor-advisory
Vulnerability Advisory
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php
Third Party Advisory third-party-advisory
VulnCheck Advisory: RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters
https://www.vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parameters

Scores

CVSS v3 8.2
EPSS 0.0026
EPSS Percentile 49.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
Next Click Ventures/RealtyScripts 4.0.2
nextclickventures/realtyscript 4.0.2
Published Mar 16, 2026
Tracked Since Mar 16, 2026