Description
Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Netartmedia | Netartmedia PHP Real Estate Agency | 4.0 | — |
References
- ExploitDB-46574 exploit
- VulnCheck Advisory: Netartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameter third-party-advisory