This vulnerability allows an attacker to perform SQL injection by manipulating the ID parameter in the /single-list_rent.php file of code-projects Real State Services 1.0. The attack vector is remote network access with no privileges or user interaction required. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although exploit code is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /single-list_rent.php. Restricting database permissions and input validation may also help reduce risk.