This vulnerability affects code-projects Real State Services 1.0. An attacker can remotely exploit an SQL injection flaw in the /loginuser.php file by manipulating the Username parameter. This could allow unauthorized database queries or data access. The CVSS 4.0 base score is 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability. No official fix or patch has been published as of the current information.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability to a limited extent. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious SQL injection attempts targeting the Username parameter in /loginuser.php.