This vulnerability affects code-projects Real State Services version 1.0. It involves an SQL injection flaw triggered by manipulating the 'amen' parameter in the /addprojectrent.php script. The vulnerability allows remote attackers to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation level at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion. The impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'amen' parameter to prevent SQL injection. Monitoring and restricting access to the vulnerable endpoint may also reduce risk.