This vulnerability in code-projects Real State Services 1.0 allows remote attackers to perform SQL injection via the ID parameter in the /single-list_rent.php file. The weakness enables unauthorized database queries due to insufficient input validation or sanitization. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. Since the exploit is publicly available, there is an increased risk of attacks targeting vulnerable installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall (WAF) rules to block malicious payloads targeting the ID parameter in /single-list_rent.php. Monitoring for unusual database queries or access patterns may also help detect exploitation attempts.